MAL-2025-15328 Malicious code in bad-idea-express-backdoor (npm)

The package bad-idea-express-backdoor was found to contain malicious code...

PT-2025-37228

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A flaw exists in the Linux kernel related to Generic Segmentation Offload GSO and IPv6 packets with extension headers. Specifically, the kernel incorrectly requests checksum offload fo...

Microsoft August 2025 Patch Tuesday Fixes Kerberos Zero-Day Among 111 Total New Flaws

Microsoft on Tuesday rolled out fixes for a massive set of 111 security flaws across its software portfolio, including one flaw that has been disclosed as publicly known at the time of the release. Of the 111 vulnerabilities, 16 are rated Critical, 92 are rated Important, two are rated Moderate,...

Linux Distros Unpatched Vulnerability : CVE-2025-37908

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: mm, slab: clean up slab-objexts always When memory allocation profiling is disabled at runti...

Linux Distros Unpatched Vulnerability : CVE-2021-28950

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in fs/fuse/fusei.h in the Linux kernel before 5.11.8. A stall on CPU can occur because a retry loop continually finds the same bad inode...

BIT-LIBPYTHON-2020-15523

In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4, and 3.9 through 3.9.0 on Windows, a Trojan horse python3.dll might be used in cases where CPython is embedded in a native application. This occurs because python3X.dll may use an invalid search path for python3.dll loading after...

Linux-Based Lenovo Webcams' Flaw Can Be Remotely Exploited for BadUSB Attacks

Cybersecurity researchers have disclosed vulnerabilities in select model webcams from Lenovo that could turn them into BadUSB attack devices. "This allows remote attackers to inject keystrokes covertly and launch attacks independent of the host operating system," Eclypsium researchers Paul...

Linux Distros Unpatched Vulnerability : CVE-2024-53878

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in the cuobjdump binary, where a user could cause a crash by passing a malformed ELF file to...

Important: nvidia-imex-570

Issue Overview: NVIDIA Display Driver for Linux and Windows contains a vulnerability in the kernel mode driver, where an attacker could access memory outside bounds permitted under normal use cases. A successful exploit of this vulnerability might lead to denial of service, data tampering, or...

MAL-2025-6677 Malicious code in undeface-test-3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5d434f28a3308a27549e2074866ae549681568f517ab1c783d210924f5d827f0 The OpenSSF Package Analysis project identified 'undeface-test-3' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

gstreamer1-plugins-bad-free security update

An update is available for gstreamer1-plugins-bad-free. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list GStreamer is a streaming media framework based on graphs ...

DEBIAN-CVE-2025-38406

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: remove WARN on bad firmware input If the firmware gives bad input, that's nothing to do with the driver's stack at this point etc., so the WARNON doesn't add any value. Additionally, this is one of the top syzbot...

The vulnerability of the Common Client Real-time Scan service of Trend Micro’s anti-virus software programs, Apex One and Apex One as a Service, allows attackers to escalate their privileges and execute arbitrary code within the SYSTEM context.

The vulnerability of Trend Micro Apex One and Apex One as a Service anti-virus software’s Common Client Real-time Scan function is related to an incorrect definition of the link before accessing the file. Exploiting this vulnerability can allow attackers to enhance their privileges and execute...

PT-2025-35985

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel where the hfsplus create attributes file function incorrectly uses BUG ON. This occurs when the volume header contains incorrect values, leading to an...

undici Denial of Service attack via bad certificate data

...

SUSE CVE-2025-38254

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add sanity checks for drmedidraw When EDID is retrieved via drmedidraw, it doesn't guarantee to return proper EDID bytes the caller wants: it may be either NULL that leads to an Oops or with too long bytes over t...

CVE-2025-38254 drm/amd/display: Add sanity checks for drm_edid_raw()

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add sanity checks for drmedidraw When EDID is retrieved via drmedidraw, it doesn't guarantee to return proper EDID bytes the caller wants: it may be either NULL that leads to an Oops or with too long bytes over t...

CVE-2025-38254

The CVE-2025-38254 issue is in the Linux kernel (drm/amd/display) where drm_edid_raw() could return NULL or oversized EDID bytes, risking an Oops or memory corruption. The fix adds sanity checks for drm_edid_raw() and returns EDID_BAD_INPUT in those corner cases. It is related to EDID handling wh...

AZL-64398 CVE-2025-38089 affecting package kernel for versions less than 6.6.96.1-1

In the Linux kernel, the following vulnerability has been resolved: sunrpc: handle SVCGARBAGE during svc auth processing as auth error tianshuo han reported a remotely-triggerable crash if the client sends a kernel RPC server a specially crafted packet. If decoding the RPC reply fails in such a w...

DEBIAN-CVE-2025-38089

In the Linux kernel, the following vulnerability has been resolved: sunrpc: handle SVCGARBAGE during svc auth processing as auth error tianshuo han reported a remotely-triggerable crash if the client sends a kernel RPC server a specially crafted packet. If decoding the RPC reply fails in such a w...