CVE-2025-21423 Improper Validation of Array Index in Display

Memory corruption occurs when handling client calls to EnableTestMode through an Escape call...

CVE-2025-21423

CVE-2025-21423 affects Qualcomm chipsets; memory corruption occurs when handling client calls to EnableTestMode through an Escape call. The CVSS-3.1 metrics indicate a LOCAL attack vector, LOW privileges required, no user interaction, with HIGH confidentiality, integrity, and availability impact....

SUSE CVE-2025-21984

In the Linux kernel, the following vulnerability has been resolved: mm: fix kernel BUG when userfaultfdmove encounters swapcache userfaultfdmove checks whether the PTE entry is present or a swap entry. - If the PTE entry is present, movepresentpte handles folio migration by setting: srcfolio-inde...

MAL-2025-191915 Malicious code in ultrafasttelethon (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 73a960b0cd2d21f8bde61f22f956a4c2a02ccddd9e1277eef23d3d8e0406cba4 Clone of Telethon package that exfiltrates credentials. See client/telegrambaseclient.py L608-626 exfiltration function and client/auth.py L163 usage. ---...

GHSA-4VJR-HFPP-2M7W expand-object Vulnerable to Prototype Pollution via the expand() Function

Versions of the package expand-object from 0.0.0 to 0.4.2 are vulnerable to Prototype Pollution in the expand function in index.js. This function expands the given string into an object and allows a nested property to be set without checking the provided keys for sensitive properties like proto...

Malicious code in colorinsa (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ea605189c0cea53175b8c70e9163dcc15333629a93b9ea991d154486c931950c Using the color function triggers attempts to exfiltrate browsers data --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

MAL-2025-3442 Malicious code in colorinsa (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ea605189c0cea53175b8c70e9163dcc15333629a93b9ea991d154486c931950c Using the color function triggers attempts to exfiltrate browsers data --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

PT-2025-27665

Name of the Vulnerable Software and Affected Versions: llama index versions prior to 0.12.28 llama index version 0.12.28 Description: The JSONReader in the affected software is vulnerable to a stack overflow due to uncontrolled recursive JSON parsing. This allows attackers to trigger a Denial of...

PT-2025-27525

Name of the Vulnerable Software and Affected Versions: llama index version 0.12.27 Description: A flaw in the ObsidianReader class allows for hardlink-based path traversal, enabling attackers to bypass path restrictions and access sensitive system files, such as /etc/passwd, by exploiting...

UBUNTU-CVE-2025-21984

In the Linux kernel, the following vulnerability has been resolved: mm: fix kernel BUG when userfaultfdmove encounters swapcache userfaultfdmove checks whether the PTE entry is present or a swap entry. - If the PTE entry is present, movepresentpte handles folio migration by setting: srcfolio-inde...

CVE-2025-21985 drm/amd/display: Fix out-of-bound accesses

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix out-of-bound accesses WHAT & HOW hpostreamtolinkencodermapping has size MAXHPODP2ENCODERS=4, but location can have size up to 6. As a result, it is necessary to check location against MAXHPODP2ENCODERS...

PT-2025-35789

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions prior to 1.11.30 Description A flaw exists in the authentication module of the Chamilo LMS OpenID system due to a lack of validation for XML object sequences. Successful exploitation could allow a remote attacker to execut...

WordPress IMPress for IDX Broker plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Peter Thaleikis in WordPress Plugin IMPress for IDX Broker versions = 3.2.3...

Malicious code in runningwifi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7c510d8dbbc3448272c337960c786b9b9731fe97773a4bfd48844527c7e6bed6 Running the module will exfiltrate files from the current directory --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

MAL-2025-3468 Malicious code in runwifi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 83046dbbe0f24ed7ffb9087d78c161e332436c45f2f3f4433606ebb9fd9cc52d Running the module will exfiltrate files from the current directory --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in sccket (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5a4f6b8eead6d682b7462da07822a284425fa81c17b9493dd8702ba6a8e5fbb7 Running the module will exfiltrate files from the current directory --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in randomwifi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 69dd88ab3dd3a84c89517f453703ddfd713ccc663b6641d5cf098e17bcdfe500 Running the module will exfiltrate files from the current directory --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

MAL-2025-3469 Malicious code in sccket (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5a4f6b8eead6d682b7462da07822a284425fa81c17b9493dd8702ba6a8e5fbb7 Running the module will exfiltrate files from the current directory --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

MAL-2025-3463 Malicious code in randomwifi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 69dd88ab3dd3a84c89517f453703ddfd713ccc663b6641d5cf098e17bcdfe500 Running the module will exfiltrate files from the current directory --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

MAL-2025-3437 Malicious code in bitcoinlibdbfix (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a5cb52fa4f2ac6a68416c59a513399e01bb388d5e238260b712a513db3d97233 It overwrites the 'clw' command from legit bitconinlib package and attempts to exfiltrate its database on the usage. As a context, it appears to be created to...