CVE-2025-64432

KubeVirt is a virtual machine management add-on for Kubernetes. Versions 1.5.3 and below, and 1.6.0 contained a flawed implementation of the Kubernetes aggregation layer's authentication flow which could enable bypass of RBAC controls. It was discovered that the virt-api component fails to...

CVE-2025-35963

Insufficient control flow management for some IntelR PROSet/Wireless WiFi Software for Windows before version 23.160 within Ring 2: Device Drivers may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of...

lemlist: Authentication Token Theft via Open Redirect in Callback URL Parameter

A vulnerability was identified in the email signup flow of a website that enabled authentication token theft through manipulation of the callback URL parameter. The vulnerability occurred when an attacker modified the callbackUrl parameter during the email signup process to point to an...

MAL-2025-114391 Malicious code in hadi-bakso96-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18164aac7d616789411257197e1d9ec3336dddc3c306dbfb974a8c74464a005f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

kernel: sched: sch_cake: add bounds checks to host bulk flow fairness counts

In the Linux kernel, the following vulnerability has been resolved: sched: schcake: add bounds checks to host bulk flow fairness counts Even though we fixed a logic error in the commit cited below, syzbot still managed to trigger an underflow of the per-host bulk flow counters, leading to an out ...

kernel: RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix mlx5pollone curqp update flow When curqp isn't NULL, in order to avoid fetching the QP from the radix tree again we check if the next cqe QP is identical to the one we already have. The bug however is that we are...

kernel: sched: sch_cake: add bounds checks to host bulk flow fairness counts

In the Linux kernel, the following vulnerability has been resolved: sched: schcake: add bounds checks to host bulk flow fairness counts Even though we fixed a logic error in the commit cited below, syzbot still managed to trigger an underflow of the per-host bulk flow counters, leading to an out ...

Malicious code in ghjcng-devapptea (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3cb8be84449e48675e06963d09248604561854f4278d6b76b0da499217f0000 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-103549 Malicious code in hanafi-moci94-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 997d7b98112050229465f4eb126eb354e2296329e89d18a4989f0a42c3948265 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in conceptual_snake_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 462a2897ec19553829060f3ca9490122e19f69dc36aae8c46809157ebc5549d3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-91889 Malicious code in vina-keraktelor57-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 301b92ad36399773a733d5ad8066c6bc3f77acb9583184368527cacaa91fbc93 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bayu-semur18-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7be6324072ade5c9d2031835fa39c433a39cfbca0e050860a32a09971206c299 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in specified-black-hookworm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 147a89f13c059a0f1f900ef4f18e322c2dd43ce1233b0b963be734f5980dd064 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in candra-takokak92-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4b94aab6bd9c02998dac8e89926e7de48d9867e6e1cccbf0982e9a0325337c0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-55342

Quipux 4.0.1 through e1774ac allows enumeration of usernames, and accessing the Ecuadorean identification number for all registered users via the Administracion/usuarios/cambiarpasswordolvidovalidar.php txtlogin parameter...

BLADE: Behavior-Level Anomaly Detection Using Network Traffic in Web Services

With their widespread popularity, web services have become the main targets of various cyberattacks. Existing traffic anomaly detection approaches focus on flow-level attacks, yet fail to recognize behavior-level attacks, which appear benign in individual flows but reveal malicious purpose using...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990564)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990564 advisory. In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix leak of nested actions While parsing user-provided actions, openvswitch...

CVE-2025-20358

A vulnerability in the Contact Center Express CCX Editor application of Cisco Unified CCX could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative permissions pertaining to script creation and execution. This vulnerability is due to improper authenticatio...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988900)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988900 advisory. In the Linux kernel, the following vulnerability has been resolved: IB/core: Fix a nested dead lock as part of ODP flow Fix a nested dead lock as part of ODP flow by...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989282)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989282 advisory. In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix memory leak in error flow for subscribe event routine In case the second xainsert...