Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987697)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987697 advisory. In the Linux kernel, the following vulnerability has been resolved: video: fbdev: clcdfb: Fix refcount leak in clcdfbofvramsetup ofparsephandle returns a node pointe...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-987701)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987701 advisory. In the Linux kernel, the following vulnerability has been resolved: net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices The probe function is only...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987704)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987704 advisory. In the Linux kernel, the following vulnerability has been resolved: um: Fix out-of-bounds read in LDT setup syscallstubdata expects the datacount parameter to be the...

CVE-2025-11938

A vulnerability was found in ChurchCRM up to 5.18.0. This vulnerability affects unknown code of the file setup/routes/setup.php. Performing a manipulation of the argument DBPASSWORD/ROOTPATH/URL results in deserialization. The attack may be initiated remotely. The attack's complexity is rated as...

MAL-2025-191838 Malicious code in pytelegramapi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d50aff9e36f41642610a858c0117318ed7483aad0e4f517a1485ca2d66574c2a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in pytelegramapi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d50aff9e36f41642610a858c0117318ed7483aad0e4f517a1485ca2d66574c2a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-191776 Malicious code in klsosdoids2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d72d2891383419bc38738c4c3be786e31a5000e46d5b3064bacf11561ad69af8 Package simulates malicious activity during installation and has no other purpose --- Category: PROBABLYPENTEST - Packages looking like typical pentest package...

MAL-2025-191762 Malicious code in huzzleup (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 96519e802e0761cc6f22ffc2dde7aee04fc6806f5831c1e98c15512792a3cd1d Package simulates malicious activity during installation and has no other purpose --- Category: PROBABLYPENTEST - Packages looking like typical pentest package...

Malicious code in klsosdoids5 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9463b9f77f9d64f5acb9c6a75b2969333be89d6d850af7e75628532ff23e0641 Package simulates calling home on import and there has no other purpose --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but als...

Malicious code in abhamzufu (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7ef1806d244274823ed462cd27dc9ec91a4c26d7bc7141bd652ecf05cb40c2dc Package simulates malicious activity during installation and has no other purpose --- Category: PROBABLYPENTEST - Packages looking like typical pentest package...

Malicious code in hamubika (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c55b19e3a5ae01340f8c4aa8a68372eda1a6d5646f63a26658a1df75b4a2cf0c Packages that either reports home installation, simulate malicious activity or imitate Roblox API wrapper. --- Category: PROBABLYPENTEST - Packages looking lik...

MAL-2025-191747 Malicious code in hamubika (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c55b19e3a5ae01340f8c4aa8a68372eda1a6d5646f63a26658a1df75b4a2cf0c Packages that either reports home installation, simulate malicious activity or imitate Roblox API wrapper. --- Category: PROBABLYPENTEST - Packages looking lik...

Security update for the Linux Kernel (Live Patch 69 for SLE 12 SP5)

This update for the Linux Kernel 4.12.14-122261 fixes several issues. The following security issues were fixed: CVE-2022-50386: Bluetooth: L2CAP: Fix user-after-free bsc1250302. CVE-2025-38499: cloneprivatemnt: make sure that caller has CAPSYSADMIN in the right userns bsc1248673. CVE-2025-21971:...

EUVD-2025-35002

A vulnerability was found in ChurchCRM up to 5.18.0. This vulnerability affects unknown code of the file setup/routes/setup.php. Performing manipulation of the argument DBPASSWORD/ROOTPATH/URL results in deserialization. The attack may be initiated remotely. The attack's complexity is rated as...

EUVD-2025-35003

A security vulnerability has been detected in LibreWolf up to 143.0.4-1 on Windows. This affects an unknown function of the file assets/setup.nsi of the component Installer. Such manipulation leads to uncontrolled search path. The attack must be carried out locally. Attacks of this nature are...

CVE-2025-11940 LibreWolf Installer setup.nsi uncontrolled search path

A security vulnerability has been detected in LibreWolf up to 143.0.4-1 on Windows. This affects an unknown function of the file assets/setup.nsi of the component Installer. Such manipulation leads to uncontrolled search path. The attack must be carried out locally. Attacks of this nature are...

CVE-2025-11940

The CVE-2025-11940 vulnerability affects LibreWolf up to 143.0.4-1 on Windows, tied to an unknown function in assets/setup.nsi of the Installer component. It enables an uncontrolled search path and requires local access from the attacker; the exploitability is described as difficult. A fix is ava...

CVE-2025-11938

A vulnerability was found in ChurchCRM up to 5.18.0. This vulnerability affects unknown code of the file setup/routes/setup.php. Performing a manipulation of the argument DBPASSWORD/ROOTPATH/URL results in deserialization. The attack may be initiated remotely. The attack's complexity is rated as...

CVE-2025-11938 ChurchCRM setup.php deserialization

A vulnerability was found in ChurchCRM up to 5.18.0. This vulnerability affects unknown code of the file setup/routes/setup.php. Performing a manipulation of the argument DBPASSWORD/ROOTPATH/URL results in deserialization. The attack may be initiated remotely. The attack's complexity is rated as...

CVE-2025-11938

ChurchCRM up to version 5.18.0 is affected by a deserialization vulnerability in the file setup/routes/setup.php. The issue arises when user-controlled values for DB_PASSWORD, ROOT_PATH, or URL are deserialized, enabling remote exploitation. Multiple connected reports consolidate this as a remote...