Malicious code in paypal-postman-lib (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2b733a611e3d27e56f4c6ee549bbcf3d88a1c823512c13797440c4c13f2712c The package's index.js imports os, fs, and https at the top level and read...

DEBIAN-CVE-2025-39876

In the Linux kernel, the following vulnerability has been resolved: net: fec: Fix possible NPD in fecenetphyresetafterclkenable The function ofphyfinddevice may return NULL, so we need to take care before dereferencing phydev...

CVE-2025-57939

Missing Authorization vulnerability in Blocksera Image Hover Effects – Elementor Addon image-hover-effects-addon-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Hover Effects – Elementor Addon: from n/a through = 1.4.4...

WordPress Accordion Plugin <= 2.3.15 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Abu Hurayra in WordPress Plugin Accordion versions = 2.3.15...

CVE-2025-10774

creationtimestamp| type| source ---|---|--- 2025-09-22 06:33:01+00:00| seen| https://gist.github.com/Darkcrai86/6cfdfdcd6e013ea61bc3bd152a222fa7 2025-09-22 07:23:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lzfusxqkz52c...

OESA-2025-2315 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: net/tls: fix kernel panic when allocpage failed We cannot set fraglist to NULL pointer when allocpage failed. It will be used in tlsstrpcheckqueueok when the nex...

CVE-2023-53422

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: fw: fix memory leak in debugfs Fix a memory leak that occurs when reading the fwinfo file all the way, since we return NULL indicating no more data, but don't free the status tracking object...

CVE-2023-53439

creationtimestamp| type| source ---|---|--- 2025-09-18 18:45:08+00:00| seen| https://gist.github.com/Darkcrai86/ccf17dabea25c9b27ea78b9948e0f17d...

RHEL 8 : udisks2 (RHSA-2025:16125)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:16125 advisory. The Udisks project provides a daemon, tools, and libraries to access and manipulate disks, storage devices, and technologies. Security Fixes: udisks...

Malicious code in axois-helper (npm)

The package axois-helper was found to contain malicious code...

GO-2025-3961 Podman Creates Temporary File with Insecure Permissions in github.com/containers/podman

Podman Creates Temporary File with Insecure Permissions in github.com/containers/podman...

Malicious code in webpikes (npm)

The package webpikes was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...

ALSA-2025:15900 Important: podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fixes: podman: Podman kube play command may overwrite host files CVE-2025-9566 For more details...

GHSA-JJ4J-X5WW-CWH9 Before action, Ash's hooks may execute in certain scenarios despite a request being forbidden

Summary Certain bulk action calls with a beforetransaction hook and no aftertransaction hook, will call the beforetransaction hook before authorization is checked and a Forbidden error is returned, when called as a bulk action. The impact is that a malicious user could cause a beforetransaction t...

PT-2025-38117

CVE-2025-55777 - Apache Non-Security Issue CVE ID : CVE-2025-55777 Published : Sept. 15, 2025, 6:15 p.m. | 2 hours, 43 minutes ago Description : Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that ...

Malicious code in tronkeypy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 15beba1021e7f60daed074087734c4a931b0b0d93695e6d1bf28aea909f41a80 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

CVE-2025-10269

creationtimestamp| type| source ---|---|--- 2025-09-12 05:12:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lymiu5td4k2x 2025-09-12 06:09:49+00:00| seen| https://gist.github.com/Darkcrai86/f5e93dd4274033704dbb452da7ce70b6...

CVE-2025-57579

An issue in TOTOLINK Wi-Fi 6 Router Series Device X2000R-Gh-V2.0.0 allows a remote attacker to execute arbitrary code via the default password...

CVE-2025-39783

In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Fix configfs group list head handling Doing a listdel on the epfgroup field of struct pciepfdriver in pciepfremovecfs is not correct as this field is a list head, not a list entry. This listdel call triggers a KASA...

CVE-2025-9160

A code execution security issue exists in the affected product. An attacker with physical access could abuse the maintenance menu of the controller with a crafted payload. The security issue can result in arbitrary code execution...