Malicious code in config-odin-io-procyon (npm)

The package config-odin-io-procyon was found to contain malicious code...

CVE-2025-58834 WordPress short.io Plugin <= 2.4.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in gugu short.io wp-shortcm allows DOM-Based XSS.This issue affects short.io: from n/a through = 2.4.2...

CVE-2025-58802 WordPress TrustMate.io – WooCommerce integration plugin <= 1.16.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in michalzagdan TrustMate.io – WooCommerce integration trustmate-io-integration-for-woocommerce allows Cross Site Request Forgery.This issue affects TrustMate.io – WooCommerce integration: from n/a through = 1.16.0...

OESA-2025-2155 gnuplot security update

Gnuplot is a portable command-line driven graphing utility for Linux, OS/2, MS Windows, OSX, VMS, and many other platforms. The source code is copyrighted but freely distributed i.e., you don't have to pay for it. It was originally created to allow scientists and students to visualize mathematica...

CVE-2025-58802: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in michalzagdan TrustMate.io – WooCommerce integration trustmate-io-integration-for-woocommerce allows Cross Site Request Forgery.This issue affects TrustMate.io – WooCommerce integration: from n/a through = 1.16.0...

PT-2025-36337

Name of the Vulnerable Software and Affected Versions fs2 versions 3.12.2 and lower fs2 versions 3.13.0-M1 through 3.13.0-M6 Description fs2, a compositional, streaming I/O library for Scala, is susceptible to denial of service attacks through TLS sessions when using fs2-io on the JVM with the...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the iouring/futex module not being properly cleaned up when iofutexwait fails...

PT-2025-36633

Impact When establishing a TLS session using fs2-io on the JVM using the fs2.io.net.tls package, if one side of the connection shuts down write while the peer side is awaiting more data to progress the TLS handshake, the peer side will spin loop on the socket read, fully utilizing a CPU. This CPU...

PT-2025-36298

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.17.0-rc1+ 102 Description: A stack buffer overflow issue exists in the send ipi data function within the Linux kernel, specifically related to the LoongArch architecture and KVM functionality. The kvm io bus...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 : Ruby vulnerabilities (USN-7734-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7734-1 advisory. It was discovered that Ruby incorrectly handled certain IO stream methods. A remote attacker could use this...

DEBIAN-CVE-2025-38712

In the Linux kernel, the following vulnerability has been resolved: hfsplus: don't use BUGON in hfspluscreateattributesfile When the volume header contains erroneous values that do not reflect the actual state of the filesystem, hfsplusfillsuper assumes that the attributes file is not yet created...

CVE-2025-38695

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Check for hdwq null ptr when cleaning up lpfcvport structure If a call to lpfcsli4readrev from lpfcsli4hbasetup fails, the resultant cleanup routine lpfcsli4vportdeletefcpxriaborted may occur before sli4hba.hdwqs are...

AZL-66794 CVE-2025-38685 affecting package kernel for versions less than 6.6.104.2-1

In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix vmalloc out-of-bounds write in fastimageblit This issue triggers when a userspace program does an ioctl FBIOPUTCON2FBMAP by passing console number and frame buffer number. Ideally this maps console to frame buffer and...

CVE-2025-38712

CVE-2025-38712 refers to a Linux kernel issue in the hfsplus code path. Root cause: when the volume header has values not reflecting the filesystem state, hfsplus_fill_super() may assume the attributes file isn’t created and call hfsplus_create_attributes_file(), hitting a BUG_ON(). The fix repla...

CVE-2025-38688

CVE-2025-38688: In the Linux kernel’s iommufd code, ALIGN() overflow could occur while allocating IOVA ranges near ULONG_MAX, risking overlapping mappings or mapping against reserved ranges. The fix uses get_add_overflow() to guard ALIGN() and consolidates the checks under a single helper. Public...

CVE-2025-36900

In lwistestregisterio of lwisdevicetest.c, there is a possible OOB Write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

iommufd: Fix protection fault in iommufd_test_syz_conv_iova

...

CVE-2025-36903

In lwisiobufferwrite, there is a possible OOB read/write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

block: mark GFP_NOIO around sysfs ->store()

...

PT-2025-35891

Name of the Vulnerable Software and Affected Versions: lwis device top affected versions not specified Description: An out-of-bounds write issue exists in the lwis top register io function within the lwis device top.c file. This could allow for local privilege escalation requiring System executio...