MAL-2025-143695 Malicious code in io-eslint-plugin-yonder-unuk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55f1228c8a0e8e5f1e992545733045dd7f98234974ca9ca788f347f162434515 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142145 Malicious code in eridanus-ganymede-hugo-io (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f8dd49354124306d6cce53a0e2081438a175d153f93a53913c5eb90407d1ea1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-112406

Malicious code in io-unuk-pegasus-concurrently npm...

Security update for the Linux Kernel (Live Patch 0 for SLE 15 SP7)

This update for the Linux Kernel 6.4.0-15070051 fixes several issues. The following security issues were fixed: CVE-2025-38664: ice: Fix a null pointer dereference in icecopyandinitpkg bsc1248631. CVE-2025-38511: drm/xe/pf: Clear all LMTT pages on alloc bsc1248176. CVE-2025-38617: net/packet: fix...

kernel: x86/tdx: Fix "in-kernel MMIO" check

A flaw was found in the Linux kernel. Userspace can deceive the kernel into performing MMIO Memory-Mapped IO operations in TDX Trust Domain Extensions on its behalf, allowing a VE Virtualization Exception to be incorrectly handled as a in-kernel MMIO operation...

kernel: rxrpc: Fix a race between socket set up and I/O thread creation

A flaw was found in the Linux kernel's rxrpc module. A race condition exists during the setup of a socket and its associated I/O thread. A remote attacker could send a specially crafted User Datagram Protocol UDP packet, which might be processed by rxrpcencaprcv before the I/O thread is fully...

kernel: block, bfq: fix waker_bfqq UAF after bfq_split_bfqq()

In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix wakerbfqq UAF after bfqsplitbfqq Our syzkaller report a following UAF for v6.6: BUG: KASAN: slab-use-after-free in bfqinitrq+0x175d/0x17a0 block/bfq-iosched.c:6958 Read of size 8 at addr ffff8881b57147d8 by task...

ALSA-2025:20095 Moderate: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: xen: Xen hypercall page unsafe against speculative attacks Xen Security Advisory 466 CVE-2024-53241 kernel: exfat: fix out-of-bounds access of directory entries CVE-2024-53147 kernel: zra...

RHEL 10 : kernel (RHSA-2025:20095)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:20095 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: xen: Xen hypercall page unsa...

Security Bulletin: IBM Jazz Reporting Service is vulnerable to uncontrolled resource consumption in Apache Commons IO.

Summary A vulnerability has been identified in the Apache Commons IO library. This issue affects IBM® Jazz Reporting Service and has been addressed as documented in the Remediation section CVE-2024-47554. Vulnerability Details CVEID:CVE-2024-47554 DESCRIPTION: Uncontrolled Resource Consumption...

PT-2025-49091

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.12.0 Description The Linux kernel contains a flaw within the nvme-fc subsystem. Specifically, the issue arises from improper handling of work queues during the deletion of an NVMe-FC controller association. The...

CVE-2025-64180 Manager-io/Manager: Complete Bypass of SSRF Protection via Time-of-Check Time-of-Use (TOCTOU)

Manager-io/Manager is accounting software. In Manager Desktop and Server versions 25.11.1.3085 and below, a critical vulnerability permits unauthorized access to internal network resources. The flaw lies in the fundamental design of the DNS validation mechanism. A Time-of-Check Time-of-Use TOCTOU...

Manager-io 代码问题漏洞

Manager-io is an open source accounting software from Manager.io. It is available for Windows, Mac and Linux. A code issue vulnerability exists in Manager-io 25.11.1.3085 and prior versions that stems from a TOCTOU condition in the DNS authentication mechanism, which could lead to bypassing netwo...

CVE-2025-64180: Time-of-check Time-of-use (TOCTOU) Race Condition

Manager-io/Manager is accounting software. In Manager Desktop and Server versions 25.11.1.3085 and below, a critical vulnerability permits unauthorized access to internal network resources. The flaw lies in the fundamental design of the DNS validation mechanism. A Time-of-Check Time-of-Use TOCTOU...

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime via the Attach functionality. An attacker can cause excessive memory consumption on the host by repeatedly initiating CRI Attach requests, leading to resource exhaustion due to goroutin...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990619)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990619 advisory. In the Linux kernel, the following vulnerability has been resolved: blk-iolatency: Fix inflight count imbalances and IO hangs on offline iolatency needs to track the...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990244)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990244 advisory. In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix races between hole punching and AIO+DIO After commit ocfs2: return real error code in...

Linux kernel io_uring Heap Buffer Overflow DoS

The vulnerability of the iolinktimeoutfn function in the fs/iouring.c module of the Linux file system support module is related to incorrect input data validation. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protecte...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988710)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988710 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix use-after-free for aborted TMF sastask Currently a use-after-free may occur if ...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988798)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988798 advisory. In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix UAF when detecting digest errors We should also bail from the iowork loop when we s...