JLSEC-2025-63 An issue was discovered in libexpat before 2.6.3

An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms where UINTMAX equals SIZEMAX...

CVE-2025-62366 Mailgen vulnerable to HTML injection and cross-site scripting via plaintext email generation

mailgen is a Node.js package that generates responsive HTML e-mails for sending transactional mail. Mailgen versions through 2.0.30 contain an HTML injection vulnerability in plaintext emails produced by the generatePlaintext method when user‑generated content is supplied. The function attempts t...

SUSE SLES15 Security Update : kernel (Live Patch 31 for SLE 15 SP4) (SUSE-SU-2025:03548-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03548-1 advisory. This update for the Linux Kernel 5.14.21-15040024133 fixes several issues. The following security issues were fixed: - CVE-2024-53168: sunrpc:...

OPENSUSE-SU-2025:15635-1 libtiff-devel-32bit-4.7.1-2.1 on GA media

These are all security issues fixed in the libtiff-devel-32bit-4.7.1-2.1 package on the GA media of openSUSE Tumbleweed...

ShinyHunters Leak Data from Qantas, Vietnam Airlines and Other Major Firms

ShinyHunters and its affiliate hackers have leaked data from 6 firms, including Qantas and Vietnam Airlines, after claiming to breach 39 companies via a Salesforce vulnerability...

Rewiring Democracy is Coming Soon

My latest book, Rewiring Democracy: How AI Will Transform Our Politics, Government, and Citizenship , will be published in just over a week. No reviews yet, but you can read chapters 12 and 34 of 43 chapters total. You can order the book pretty much everywhere, and a copy signed by me here. Pleas...

CVE-2025-9265 API Authentication Bypass via Header Spoofing vulnerability in Kiloview NDI N30 Products

A broken authorization vulnerability in Kiloview NDI N30 allows a remote unauthenticated attacker to deactivate user verification, giving them access to state changing actions that should only be initiated by administratorsThis issue affects Kiloview NDI N30 and was fixed in Firmware version late...

CVE-2025-62158

Frappe Learning is a learning system that helps users structure their content. In versions prior to 2.38.0, the system did stored the attachments uploaded by the students in their assignments as public files. This issue potentially exposed student-uploaded files to the public. Anyone with the fil...

CVE-2025-21069

Out-of-bounds read in the parsing of image data in Samsung Notes prior to version 4.4.30.63 allows local attackers to access out-of-bounds memory...

RondoDox: From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits

Trend™ Research and ZDI Threat Hunters have identified a large-scale RondoDox botnet campaign exploiting over 50 vulnerabilities across more than 30 vendors, including flaws first seen in Pwn2Own contests...

Linux Distros Unpatched Vulnerability : CVE-2025-39899

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm/userfaultfd: fix kmaplocal LIFO ordering for CONFIGHIGHPTE With CONFIGHIGHPTE on 32-bit ARM, movepagespte maps PTE pages using kmaplocalpage, which requires...

CVE-2022-50539

In the Linux kernel, the following vulnerability has been resolved: ARM: OMAP2+: omap4-common: Fix refcount leak bug In omap4sraminit, offindcompatiblenode will return a node pointer with refcount incremented. We should use ofnodeput when it is not used anymore...

EUVD-2010-5305

Malware in sbrugna...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-986771)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986771 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: scsidebug: Fix type in mint to avoid stack OOB Change mint to use type u32 instead of type...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-400984)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-400984 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf: Fix hashtab overflow check on 32-bit arches The hashtab code relies on rounduppowoftwo to...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that originates from a 31-bit left shift of a signed 32-bit value resulting in undefined behavior, which could lead to undefined...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql (UTSA-2025-984871)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-984871 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior an...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-399446)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-399446 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stackmap overflow check on 32-bit arches The stackmap code relies on rounduppowoftwo to...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: emacs (UTSA-2025-986127)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986127 advisory. In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point for code completion on untrusted Emacs Lisp source code can trigger...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql (UTSA-2025-986142)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986142 advisory. Vulnerability in the MySQL Client product of Oracle MySQL component: C API. Supported versions that are affected are 5.7.32 and prior and 8.0.22 and prior. Difficult...