MAL-2025-82430 Malicious code in xaver-kentang79-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35e7f1ac1a765710f2fc40d771e287f6b3c1853e47b11b86baf997358868a777 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-76240 Malicious code in wibowo-jamblang59-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 264c13d6e585c90e24549df58b490fcf5e30e2267212c581fa7d20ebc1ab7bea This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in opposite-lime-cheetah (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52ff88ebe00d3b5760aef3f55b9e96a7d2b1bafd325e83a41d9255bfe3a2fe98 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-68861 Malicious code in independent-silver-turtle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5146524a5491b8f8b5b0d7c09096983c8cad001e274ccbbf4cd31e4e6fa070d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

WordPress Shelf Planner plugin <= 2.7.0 - Missing Authorization to Unauthenticated Settings Update vulnerability

Missing Authorization to Unauthenticated Settings Update vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Shelf Planner versions = 2.7.0...

Malicious code in damaged_sheep_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5969346aa18fa96f43ced9a4499893613e2db1ae785053296165e1d84dfdd031 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

java-1.8.0-openjdk security update

1.8.0.472.b08-1.0.1 - Update to 8u472-b08 GA Orabug: 38571645 - Update release notes for 8u472-b08. - Drop local JDK-8339414 fix as this is now included upstream - Reset rpmrelease to 1 now there are no other RPM builds on RHEL 8 - Sync the copy of the portable specfile with the latest update -...

SigTest Software Advisory

Summary: A potential security vulnerability in some SigTest software may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2025-22391 Description: Improper access control for some SigTest before version...

Intel® Graphics Advisory

Summary: Potential security vulnerabilities for some Intel® Graphics software may allow escalation of privilege or denial of service. Intel is releasing software updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2025-32091 Description: Incorrect default...

Intel® PROSet/Wireless WiFi Software Advisory

Summary: Potential security vulnerabilities for some Intel® PROSet/Wireless WiFi Software may allow denial of service. Intel is releasing software updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2025-35971 Description: Out-of-bounds write for some Intel®...

KB5071813: Servicing stack update for Windows Server 2012: November 11, 2025

None None...

KB5068783: Servicing stack update for Windows Server 2012 R2: November 11, 2025

None None...

Oracle Linux 9 : kernel (ELSA-2025-19930)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-19930 advisory. - x86/vmscape: Add old Intel CPUs to affected list Waiman Long RHEL-114270 CVE-2025-40300 - x86/vmscape: Warn when STIBP is disabled with SMT Waiman...

Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2025-20560)

The remote Oracle Linux 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-20560 advisory. 5.4.17-2136.347.6.1 - x86/vmscape: Warn when STIBP is disabled with SMT Pawan Gupta Orabug: 38343661 - x86/bugs: Move cpubugssmtupdate down Pawan Gupta...

Publish Your Threat Models! the Benefits Far Outweigh the Dangers

Threat modeling has long guided software development work, and we consider how Public Threat Models PTM can convey useful security information to others. We list some early adopter precedents, explain the many benefits, address potential objections, and cite regulatory drivers. Internal threat...

KLA90053 PE vulnerability in Microsoft SQL Server

An elevation of privilege vulnerability was found in Microsoft SQL Server. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2025-59499 Related products Microsoft-SQL-Server Microsoft-Azure CVE list CVE-2025-59499 critical KB list 5068405 5068403 5068401...

RHEL 10 : vim (RHSA-2025:21015)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:21015 advisory. Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim path traversal CVE-2025-53906 vim: Vim path...

.NET 9.0 Update - November 11, 2025 (KB5071067)

None None...

CVE-2025-64529

SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions prior to 1.45.2, users who use the exclusion operator somewhere in their authorization schema; have configured their SpiceDB server such that...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the WriteRelationships function when the exclusion operator is used in the authorization schema and the server is configured with --write-relationships-max-updates-per-call greater...