DEBIAN-CVE-2023-52988

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/via: Avoid potential array out-of-bound in addsecretdacpath sndhdagetconnections can return a negative error code. It may lead to accessing 'conn' array at a negative index. Found by Linux Verification Center...

UBUNTU-CVE-2023-52988

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/via: Avoid potential array out-of-bound in addsecretdacpath sndhdagetconnections can return a negative error code. It may lead to accessing 'conn' array at a negative index. Found by Linux Verification Center...

CVE-2025-25086

Cross-Site Request Forgery CSRF vulnerability in WPDeveloper Secret Meta facebook-secret-meta allows Reflected XSS.This issue affects Secret Meta: from n/a through = 1.2.1...

CVE-2025-25086 WordPress Secret Meta plugin <= 1.2.1 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability

Cross-Site Request Forgery CSRF vulnerability in WPDeveloper Secret Meta facebook-secret-meta allows Reflected XSS.This issue affects Secret Meta: from n/a through = 1.2.1...

CVE-2025-25086 WordPress Secret Meta plugin <= 1.2.1 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability

Cross-Site Request Forgery CSRF vulnerability in WPDeveloper Secret Meta facebook-secret-meta allows Reflected XSS.This issue affects Secret Meta: from n/a through = 1.2.1...

CVE-2025-25086

CVE-2025-25086 is a CSRF-induced Reflected XSS in the WordPress plugin WPDeveloper Secret Meta, affecting Secret Meta versions up to 1.2.1 (inclusive). The Initial Description confirms the flaw type and affected range; connected sources corroborate a CSRF/Reflected XSS pattern but do not provide ...

WordPress plugin Secret Meta 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

The vulnerability of the OpenSSL library, related to the hidden time channel, allows a hacker to recover the secret key.

The vulnerability of the OpenSSL library is related to a hidden time channel. Exploiting this vulnerability allows a malicious actor, operating remotely, to recover the secret key...

Malicious code in nylas-apex-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 86275583c18eae2d336cf927f8e7a3a259fa70c98e0316305e579a4e6d11352e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2731 Malicious code in ethers-provider2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64291b6905fba089a2dada5e0215c20954bf12f15f76d27c5c341d2b91baa81b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in eslint-config-hectorm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2f6f7f9a7ef4ddc982849df1b0144158db3f60bef6633d7797c6f25a18cc2ec2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Supply Chain Compromise of Third-Party tj-actions/changed-files (CVE-2025-30066) and reviewdog/action-setup@v1 (CVE-2025-30154)

A popular third-party GitHub Action, tj-actions/changed-files tracked as CVE-2025-30066link is external, was compromised. tj-actions/changed-files is designed to detect which files have changed in a pull request or commit. The supply chain compromise allows for information disclosure of secrets...

BIT-NGINX-INGRESS-CONTROLLER-2025-24513 ingress-nginx controller - auth secret file path traversal vulnerability

A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This could result in denial of service, or...

BIT-NGINX-INGRESS-CONTROLLER-2025-24514 ingress-nginx controller - configuration injection via unsanitized auth-url annotation

A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the auth-url Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets...

CVE-2025-29311

Limited secret space in LLDP packets used in onos v2.7.0 allows attackers to obtain the private key via a bruteforce attack. Attackers are able to leverage this vulnerability into creating crafted LLDP packets...

Multiple vulnerabilities in Ingress NGINX Controller for Kubernetes

On March 24, 2025, Kubernetes disclosed 5 new vulnerabilities affecting the Ingress NGINX Controller for Kubernetes. Successful exploitation could allow attackers access to all secrets stored across all namespaces in the Kubernetes cluster, which could result in cluster takeover. CVE-2025-1974 9....

Multiple vulnerabilities in Ingress NGINX Controller for Kubernetes

On March 24, 2025, Kubernetes disclosed 5 new vulnerabilities affecting the Ingress NGINX Controller for Kubernetes. Successful exploitation could allow attackers access to all secrets stored across all namespaces in the Kubernetes cluster, which could result in cluster takeover. CVE-2025-1974 9....

CVE-2025-1097

A flaw was found in ingress-nginx https://github.com/kubernetes/ingress-nginx where the auth-tls-match-cn Ingress annotation can be used to inject configuration into nginx. This issue can lead to arbitrary code execution in the context of the ingress-nginx controller and disclosure of Secrets...

Malicious code in cln-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 56b9cc716f2f19131b4daf97b6c72c4b58b5b71d337760dc41188971098e4fb1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2693 Malicious code in node-clog (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b79afa3c5e7683904826177bb23fa862588f63570cd13fdb1aeda910d3c5ec81 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...