bind: Cache poisoning attacks with unsolicited RRs

A vulnerability exists in BIND’s DNS resolver logic that makes it overly permissive when accepting resource records RRs in responses. Under certain conditions, this flaw allows attackers to inject unsolicited or forged DNS records into the cache. This can be exploited to poison the resolver cache...

bind: Resource exhaustion via malformed DNSKEY handling

A vulnerability was found in BIND 9 resolvers, where processing malformed DNSKEY records from a specially crafted zone can lead to resource exhaustion, primarily causing excessive CPU utilization. This issue enables a remote, unauthenticated attacker to degrade resolver performance and potentiall...

CVE-2025-40160

CVE-2025-40160: In the Linux kernel Xen event handling, find_virq() now returns -EEXIST when a VIRQ bound to a different CPU, replacing the previous BUG_ON() path. This affects per-domain/global VIRQs (which must be bound to CPU0 before migration). A second bind for per-domain/global VIRQs is tre...

CVE-2025-40160 xen/events: Return -EEXIST for bound VIRQs

In the Linux kernel, the following vulnerability has been resolved: xen/events: Return -EEXIST for bound VIRQs Change findvirq to return -EEXIST when a VIRQ is bound to a different CPU than the one passed in. With that, remove the BUGON from bindvirqtoirq to propogate the error upwards. Some VIRQ...

CVE-2025-40160 xen/events: Return -EEXIST for bound VIRQs

In the Linux kernel, the following vulnerability has been resolved: xen/events: Return -EEXIST for bound VIRQs Change findvirq to return -EEXIST when a VIRQ is bound to a different CPU than the one passed in. With that, remove the BUGON from bindvirqtoirq to propogate the error upwards. Some VIRQ...

CVE-2025-12908

Insufficient validation of untrusted input in Downloads in Google Chrome allowed a remote attacker to perform domain spoofing via a crafted HTML page...

Malicious code in slidev-markdown-pdf-vuepress-optimize-css-assets-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57f9611682bc34cb71257391b5f249a4e48a1a84cc36893dceb88e5bdf22c29c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in neptune-version-eris-kronos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d0d74d8bf9d662ccbb903d0bbf47640da6df42e2465abce2007ff3446c08fd9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

kdcproxy 安全漏洞

kdcproxy is a Python library open-sourced by latchset. A security vulnerability exists in kdcproxy that stems from a default query of DNS SRV records, which could lead to a server-side request forgery attack...

ROS-20251112-04

The FreeIpa server vulnerability is related to the fact that the application does not check the canonical name root@REALM, which can also be used as a realm administrator name. Exploitation of the vulnerability could allow an attacker acting remotely to escalate privileges from the host level to...

Important: bind9.18 security update

BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Name System protocols. BIND includes a DNS server named, which resolves host names to IP addresses; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server ...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990851)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990851 advisory. In the Linux kernel, the following vulnerability has been resolved: afunix: Fix data races in unixreleasesock/unixstreamsendmsg A data-race condition has been...

ALSA-2025:21110 Important: bind security update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

PT-2025-46675

Name of the Vulnerable Software and Affected Versions kdcproxy affected versions not specified Description kdcproxy is susceptible to a server-side request forgery condition. When kdcproxy processes a request for a realm lacking defined server addresses in its configuration, it defaults to queryi...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via DNS discovery. An attacker can access internal network resources and exfiltrate data by sending crafted requests for realms that trigger DNS queries to attacker-controlled zones. Workaround This...

The vulnerability of the Downloads component in the Google Chrome browser allows a hacker to perform domain substitution attacks.

The vulnerability of the Downloads component in the Google Chrome browser is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to perform domain substitution using a specially created HTML page...

ALSA-2025:21139 Important: python-kdcproxy security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

Malicious code in candra-kue8-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02a061a2712b7285a51f8ae5061c8d61d13fb45a2207d6b26ecfa3873e9de91f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-130038 Malicious code in sari-lapis19-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15f42c3186cfc21af0ccae468afe439489bb599f101e687f7607bd4548f91280 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-124454 Malicious code in yanti-klentik36-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3efc168aa84b23c05c04445013c15916efd96df0f2d22ae17da727694f78f35b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...