CVE-2025-53908 RomM vulnerable to Authenticated Path Traversal

RomM is a self-hosted rom manager and player. Versions prior to 3.10.3 and 4.0.0-beta.3 have an authenticated path traversal vulnerability in the /api/raw endpoint. Anyone running the latest version of RomM and has multiple users, even unprivileged users, such as the kiosk user in the official...

MAL-2025-5874 Malicious code in @gdcorp-digitalcare/ux (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8da7a1bf146c62ef01e4c0f8e5fb152aaff95eb02a94acb2909faff2779f3da8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5918 Malicious code in grabcad-ui-elements (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ee52ce65db4a7eae9515a5809a148be63f55d250702390c261cd05e173132799 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-53031

...

CVE-2025-50093

CVE-2025-50093 is referenced in connected documents as a MySQL Server vulnerability (DDL component) affecting 8.0.0–8.0.42, 8.4.0–8.4.5 and 9.0.0–9.3.0 with high-privilege network access that can cause a hang or crash (DoS). The connected IBM/MiracleLinux Rocky/ Rocky-Linux advisories confirm its...

CVE-2025-50093

...

CVE-2025-50084

Removed by vendor...

CVE-2025-50068

...

CVE-2025-30759

...

CVE-2025-30750

...

MAL-2025-5887 Malicious code in agent-configurator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e65ce26b3c1e446de253231422a7c11c3d90e68dcd8caab1efbdba56150e10a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5956 Malicious code in shared-workflows (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d2e9e3bd8389efce3114016d94776de4d6947e98d829761b9bb1be64e02ff66 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5879 Malicious code in @indigo-web/material (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 97079bfe959e2a931df0187447b063d5c5fc0998cf573097f9fb9fb36105d6a4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE-SU-2025:02308-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2022-50085: dm raid: fix address sanitizer warning in raidresume bsc1245147. - CVE-2022-50087: firmware: armscpi: Ensure scpiinfo is not assigned if the probe...

[SECURITY] Fedora 41 Update: pam-1.6.1-8.fc41

PAM Pluggable Authentication Modules is a system security tool that allows system administrators to set authentication policy without having to recompile programs that handle authentication...

Achieving Zero-Disruption Patch Management with Qualys’ Latest Capabilities

Keeping systems patched is essential, but doing it efficiently and confidently is what sets great IT operations apart. With the latest capabilities in Qualys Patch Management, you can achieve just that. The most recent advancements in Qualys Patch Management – Intelligent Job Chaining and...

CVE-2025-38315

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: Check dsbr size from EFI variable Since the size of struct btinteldsbr is already known, we can just start there instead of querying the EFI variable size. If the final result doesn't match what we expect also...

CVE-2025-38314

In the Linux kernel, the following vulnerability has been resolved: virtio-pci: Fix result size returned for the admin command completion The result size returned by virtiopciadmindevpartsget is 8 bytes larger than the actual result data size. This occurs because the resultsgsize field of the...

CVE-2025-38306

In the Linux kernel, the following vulnerability has been resolved: fs/fhandle.c: fix a race in call of haslockedchildren maydecodefh is calling haslockedchildren while holding no locks. That's an oopsable race... The rest of the callers are safe since they are holding namespacesem and are...

CVE-2025-38304

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix NULL pointer deference on eirgetservicedata The len parameter is considered optional so it can be NULL so it cannot be used for skipping to next entry of EIRSERVICEDATA...