CVE-2025-61084

MDaemon Mail Server 23.5.2 validates SPF, DKIM, and DMARC using the email enclosed in angle brackets in the From: header of SMTP DATA. An attacker can craft a From: header with multiple invisible Unicode thin spaces to display a spoofed sender while passing validation, allowing email spoofing eve...

Specification-Guided Vulnerability Detection with Large Language Models

Large language models LLMs have achieved remarkable progress in code understanding tasks. However, they demonstrate limited performance in vulnerability detection and struggle to distinguish vulnerable code from patched code. We argue that LLMs lack understanding of security specifications -- the...

Low: unbound

Issue Overview: No CVE associated with this advisory Affected Packages: unbound Note: This advisory is applicable to Amazon Linux 2 - Unbound-1.17 Extra. Visit this page to learn more about Amazon Linux 2 AL2 Extras and this FAQ section for the difference between AL2 Core and AL2 Extras advisorie...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990296)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990296 advisory. In the Linux kernel, the following vulnerability has been resolved: mfd: intelsocpmicbxtwc: Use IRQ domain for USB Type-C device While design wise the idea of...

PT-2025-45169

Name of the Vulnerable Software and Affected Versions DataEase versions 2.10.14 and below Description DataEase is a data visualization analysis tool. Versions 2.10.14 and below lack proper protection for the dns:// protocol, leading to a Server-Side Request Forgery SSRF condition. The vendor...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988979)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988979 advisory. In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix potential memory leak in intelsetupirqremapping After commit e3beca48a45b...

Ubuntu 22.04 LTS / 24.04 LTS / 25.04 / 25.10 : Unbound vulnerability (USN-7855-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.04 / 25.10 host has packages installed that are affected by a vulnerability as referenced in the USN-7855-1 advisory. Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin Duan discovered that Unbound incorrectly handled certain promiscuous NS RRSets. A remot...

ALSA-2025:19835 Important: bind security update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

Samba WINS hook RCE (CVE-2025-10230)

In the front-end WINS hook handling: NetBIOS names from registration packets are passed to a shell without proper validation or escaping. Unsanitized NetBIOS name data from WINS registration packets are inserted into a shell command and executed by the Samba Active Directory Domain Controller's...

Low: unbound

Issue Overview: No CVE associated with this advisory Affected Packages: unbound Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Run yum update unbound or yum update...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988961)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988961 advisory. In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Fix potential VPE leak on error In itsvpeirqdomainalloc, when itsvpeinit...

Amazon Linux 2 : unbound, --advisory ALAS2-2025-3055 (ALAS-2025-3055)

The version of unbound installed on the remote host is prior to 1.7.3-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-3055 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number...

RHEL 8 : bind9.16 (RHSA-2025:19793)

"The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:19793 advisory. The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named...

USN-7855-1: Unbound vulnerability

Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin Duan discovered that Unbound incorrectly handled certain promiscuous NS RRSets. A remote attacker could possibly use this issue to perform a domain hijack attack...

USN-7855-1 unbound vulnerability

Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin Duan discovered that Unbound incorrectly handled certain promiscuous NS RRSets. A remote attacker could possibly use this issue to perform a domain hijack attack...

MAL-2025-49352 Malicious code in react-paypal-braintree-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ebbf8ad1d1a557ec443c0f6ea58587954750259557188b27491cca78c7e9ea7 The package react-paypal-braintree-demo was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in react-paypal-braintree-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ebbf8ad1d1a557ec443c0f6ea58587954750259557188b27491cca78c7e9ea7 The package react-paypal-braintree-demo was found to contain malicious code. Source: ossf-package-analysis...

MAL-2025-49351 Malicious code in @isv-occ-payment/occ-payment-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6435cd052d81a7abf539cf06234ea4e9bb102c08202d0a6856c46e4826e02ab The package @isv-occ-payment/occ-payment-service was found to contain malicious code. Source: ghsa-malware...

Malicious code in @isv-occ-payment/occ-payment-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6435cd052d81a7abf539cf06234ea4e9bb102c08202d0a6856c46e4826e02ab The package @isv-occ-payment/occ-payment-service was found to contain malicious code. Source: ghsa-malware...

RUSTSEC-2025-0154 `replit_ruspty` was removed from crates.io for malicious code

The OpenSSF Package Analysis project identified 'replitruspty' @ 1.0.0 crates.io as malicious. Version 2.0.0 was also published with malware. It is considered malicious because: The package communicates with a domain associated with malicious activity. The package executes one or more commands...