Malicious Package

Overview lululemon-b2b-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2025-64483 Wazuh API – Agent Configuration Has Improper Access Control in Agent Enrollment Endpoint

Wazuh is a security detection, visibility, and compliance open source project. From version 4.9.0 to before 4.13.0, the Wazuh API – Agent Configuration in certain configurations allows authenticated users with read-only API roles to retrieve agent enrollment credentials through the...

EUVD-2025-198510

Wazuh is a security detection, visibility, and compliance open source project. From version 4.9.0 to before 4.13.0, the Wazuh API – Agent Configuration in certain configurations allows authenticated users with read-only API roles to retrieve agent enrollment credentials through the...

EUVD-2025-198217

Malicious code in lululemon-b2b-utils npm...

Malicious code in lululemon-b2b-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b05944949ea944b00cec776df6ca73a7d3cdb15f30d578047b75225e8c04cb45 The package lululemon-b2b-utils was found to contain malicious code. Source: ghsa-malware...

CVE-2025-40162

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd/sdwutils: avoid NULL deref when devmkasprintf fails devmkasprintf may return NULL on memory allocation failure, but the debug message prints cpus-dainame before checking it. Move the devdbg call after the NULL check to...

RHSA-2025:20145 Red Hat Security Advisory: shadow-utils security update

Bulletin has no description...

CVE-2025-40162 ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd/sdwutils: avoid NULL deref when devmkasprintf fails devmkasprintf may return NULL on memory allocation failure, but the debug message prints cpus-dainame before checking it. Move the devdbg call after the NULL check to...

Linux Distros Unpatched Vulnerability : CVE-2025-40162

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ASoC: amd/sdwutils: avoid NULL deref when devmkasprintf fails devmkasprintf may return NULL on memory allocation failure, but the debug message prints...

RHSA-2025:20559 Red Hat Security Advisory: shadow-utils security update

Bulletin has no description...

EUVD-2025-50836

Malicious code in tensor-fi-utils-lib npm...

Malicious code in tensor-fi-utils-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5e019daea1bdfd44c0cf583f38cd83ec5b2073b8b494e8ff91905e0b2f2f88e The package tensor-fi-utils-lib was found to contain malicious code. Source: ghsa-malware...

MAL-2025-66551 Malicious code in tensor-fi-utils-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5e019daea1bdfd44c0cf583f38cd83ec5b2073b8b494e8ff91905e0b2f2f88e The package tensor-fi-utils-lib was found to contain malicious code. Source: ghsa-malware...

ALSA-2025:20559 Low: shadow-utils security update

The shadow-utils packages include programs for converting UNIX password files to the shadow password format, as well as utilities for managing user and group accounts. Security Fixes: shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise CVE-2024-56433 For...

Amazon Linux 2 : amazon-efs-utils, --advisory ALAS2-2025-3076 (ALAS-2025-3076)

The version of amazon-efs-utils installed on the remote host is prior to 2.4.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3076 advisory. regex is an implementation of regular expressions for the Rust language. The regex crate features built-in...

Important: amazon-efs-utils

Issue Overview: regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those tunable mitigations already provide sane...

Incorrect Permission Assignment for Critical Resource

Overview Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource via the hostDisk process in the virt-handler component when mounting a host file or directory using the DiskOrCreate option. An attacker can gain unauthorized access to and modify...

Incorrect Permission Assignment for Critical Resource

Overview Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource via the hostDisk process in the virt-handler component when mounting a host file or directory using the DiskOrCreate option. An attacker can gain unauthorized access to and modify...

openSUSE Security Advisory (SUSE-SU-2025:3954-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

@kontaa/subgraph (>=1.0.1, <=1.2.3), @kontaa/utils (>=1.2.1, <=1.2.3) +4 more potentially affected by CVE-2025-64430 via parse-server (>=5.6.0, <=6.5.11)

parse-server NPM version =5.6.0, =1.0.1, =1.2.1, =2.4.46, =1.0.0, =1.0.1, =1.0.23 - servable-publishable 1.1.0 Source cves: CVE-2025-64430 Source advisory: SNYK:JS-PARSESERVER-13843716...