Malicious code in powerbi-visuals-powerkpi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1708aa2b758d41b3666672f4afb039a73cdfa12345a815feb095ca94f0fcf900 The OpenSSF Package Analysis project identified 'powerbi-visuals-powerkpi' @ 9.0.1 npm as malicious. It is considered malicious because: - The...

MAL-2025-6678 Malicious code in ledger-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 213b191babc7191e43f7c5440581518cecd61302d3870b5fbbe6f20266b8e9cf The OpenSSF Package Analysis project identified 'ledger-provider' @ 1337.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2025-6389 Malicious code in component-detection (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f3a39749aff9077de404b02560689e90881fa26e3c3b9880016fb91af8700683 The OpenSSF Package Analysis project identified 'component-detection'...

D-Link DI-8200 安全漏洞

D-Link DI8200 is an Internet behavior management router designed by D-Link for small and medium-sized network environments, which supports multi-line bandwidth overlay, PPPoE authentication billing, and intelligent traffic control. The D-Link DI8200 suffers from a buffer overflow vulnerability,...

MAL-2025-6349 Malicious code in inditextech (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 455c80b36b4b1ba97172a5cd0ebbe04c6b7fd35f405aeaa3d570ae77522dc433 The OpenSSF Package Analysis project identified 'inditextech' @ 10.0.3 npm as malicious. It is considered malicious because: - The package...

CBL Mariner 2.0 Security Update: libxml2 (CVE-2025-49796)

The version of libxml2 installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-49796 advisory. - A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can...

java-1.8.0-openjdk security update

An update is available for java-1.8.0-openjdk. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime...

zlib: Out-of-bound pointer arithmetic in inftrees.c

A vulnerability was discovered in the inftrees.c file of zlib. Pointer arithmetic operations violate the C standard by subtracting an offset from an array pointer before its allocated memory, leading to undefined behavior...

sqlite: Integer Truncation in SQLite

A memory corruption flaw was found in SQLite. Under specific conditions a query can be generated where the number of aggregate terms could exceed the number of columns available. This issue could lead to memory corruption and subsequent unintended behavior...

kernel: ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead

In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix NULL pointer dereference in isftracetrampoline when ftrace is dead ftracestartup does not remove ops from ftraceopslist when ftracestartupenable fails: registerftracefunction ftracestartup registerftracefunction...

Malicious code in fuzzponent (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7c090409f91fd478642c58e1c30b8fc667878e0128355fb88448e4ebed4d8aa9 Any computer that has this package installed or running should be considered...

MAL-2025-6255 Malicious code in redux-probe-unknown-action-rce (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d273d8be87dc1aaa71222024d9f545d4ec9bde08234f27b0c9c81f6dd8c86721 The OpenSSF Package Analysis project identified...

SUSE-SU-2025:02529-1 Security update for MozillaFirefox, MozillaFirefox-branding-SLE

This update for MozillaFirefox, MozillaFirefox-branding-SLE fixes the following issues: MozillaFirefox is updated to the 140ESR series. Firefox Extended Support Release 140.0esr ESR: General - Reader View now has an enhanced Text and Layout menu with new options for character spacing, word spacin...

MAL-2025-6240 Malicious code in xp-anti-fraud-js-lib (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f4628140ad8ca2bfe8fde97530e932f9f26df49b3841157bc7f8aa50535e77f7 The OpenSSF Package Analysis project identified 'xp-anti-fraud-js-lib...

DEBIAN-CVE-2025-38415

In the Linux kernel, the following vulnerability has been resolved: Squashfs: check return result of sbminblocksize Syzkaller reports an "UBSAN: shift-out-of-bounds in squashfsbioread" bug. Syzkaller forks multiple processes which after mounting the Squashfs filesystem, issues an ioctl"/dev/loop0...

Subliminal Learning in AIs

Today's freaky LLM behavior: We study subliminal learning, a surprising phenomenon where language models learn traits from model-generated data that is semantically unrelated to those traits. For example, a "student" model learns to prefer owls when trained on sequences of numbers generated by a...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the nfsd module not verifying that it is a v4 composite request, which could lead to undefined behavior...

MAL-2025-6229 Malicious code in airbnb-prop (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8aacf36d756bbb283dfe3340b8b1a4f2e5d7f9d2b0d662eba57f8e675728055e Any computer that has this package installed or running should be considered...

Malicious code in ui-data-layer (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8a48f1cd7920a46266b710e80c45543e765af5de9e2944c114bf249efe69ce17 The OpenSSF Package Analysis project identified 'ui-data-layer' @...

Malicious code in google-protobuf-conformance (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8c56504427d8d150c02bac6d80c813025eafa11c3ed21419e5a3ce13a6c11ca6 Any computer that has this package installed or running should be considered...