CVE-2025-7378 An improper input validation vulnerability was found on manipulating configuration of ADM

An improper Input Validation vulnerability allows injecting arbitrary values of the NAS configuration file in ASUSTOR ADM. This could potentially lead to system misconfiguration and break the format of the configuation file, causing the NAS to exhibit unexpected behavior. This issue affects ADM:...

CVE-2025-7378

ASUSTOR ADM CVE-2025-7378 is an improper input validation vulnerability affecting ADM versions 4.1 through 4.3.1.R5A0, allowing arbitrary values to be injected into the NAS configuration file and potentially causing misconfiguration and unexpected NAS behavior. The issue is mitigated by updating ...

CVE-2025-31326

CVE-2025-31326 affects SAP BusinessObjects Business Intelligence Platform (Web Intelligence). HTML Injection is possible in specific input fields with only basic user privileges, potentially causing unintended redirects or manipulation of application behavior. Impact is limited to integrity; conf...

zlib: Out-of-bound pointer arithmetic in inftrees.c

A vulnerability was discovered in the inftrees.c file of zlib. Pointer arithmetic operations violate the C standard by subtracting an offset from an array pointer before its allocated memory, leading to undefined behavior...

PT-2025-28435 · Emac · Emac

Name of the Vulnerable Software and Affected Versions: EMAC affected versions not specified Description: The issue is related to memory corruption that occurs while copying the result to the transmission queue in EMAC. This corruption can potentially lead to unintended behavior or crashes...

PT-2025-32998

Name of the Vulnerable Software and Affected Versions: ImageMagick versions prior to 6.9.13-27 ImageMagick versions prior to 7.1.2-1 Description: ImageMagick is a free and open-source software suite for editing and manipulating digital images. A function-type-mismatch exists in the splay tree...

webkitgtk: A malicious website may cause unexpected cross-origin behavior

A flaw was found in WebKit. This flaw allows a remote attacker to trigger unexpected cross-origin behavior via a malicious website...

CVE-2025-38230

In the Linux kernel, the following vulnerability has been resolved: jfs: validate AG parameters in dbMount to prevent crashes Validate dbagheight, dbagwidth, and dbagstart in dbMount to catch corrupted metadata early and avoid undefined behavior in dbAllocAG. Limits are derived from L2LPERCTL,...

UBUNTU-CVE-2025-38195

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix panic caused by NULL-PMD in hugepteoffset ERROR INFO: CPU 25 Unable to handle kernel paging request at virtual address 0x0 ... Call Trace: hugepteoffset+0x3c/0x58 hugetlbfollowpagemask+0x74/0x438...

CVE-2025-38230

CVE-2025-38230 concerns the Linux kernel’s JFS subsystem. The issue arises from not validating AG parameters in dbMount(), allowing corrupted metadata to reach dbAllocAG and cause crashes. A UBSAN shift-out-of-bounds occurs in fs/jfs/jfs_dmap.c:1400 during dbAllocAG, as demonstrated by the trace ...

CVE-2025-38230 jfs: validate AG parameters in dbMount() to prevent crashes

In the Linux kernel, the following vulnerability has been resolved: jfs: validate AG parameters in dbMount to prevent crashes Validate dbagheight, dbagwidth, and dbagstart in dbMount to catch corrupted metadata early and avoid undefined behavior in dbAllocAG. Limits are derived from L2LPERCTL,...

RUSTSEC-2025-0165 i_tree allowed out-of-bounds access through safe public node accessors

Affected versions of itree exposed safe public Tree::node and Tree::mutnode methods in the public tree module. These methods accepted an arbitrary u32 index and passed it directly to Vec::getunchecked / getuncheckedmut on the internal node buffer, without validating that the index was in bounds...

RVISmith: Fuzzing Compilers for RVV Intrinsics

Modern processors are equipped with single instruction multiple data SIMD instructions for fine-grained data parallelism. Compiler auto-vectorization techniques that target SIMD instructions face performance limitations due to insufficient information available at compile time, requiring...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from a TOCTOU competition condition leading to undefined behavior...

SUSE CVE-2025-34075

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Initially assigned to document an issues that allows guest VM to modify the host's Vagrantfile via default synced folder, leading to host-side code execution. Rejected as CVE due to documented, intended behavior that does...

AZL-70621 CVE-2025-38096 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: don't warn when if there is a FW error iwltransreclaim is warning if it is called when the FW is not alive. But if it is called when there is a pending restart, i.e. after a FW error, there is no need to warn,...

Malicious code in stencil-module-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e7b81d9bc05cb0363e0a13a4f3ec52001cae4fcb470f11f0973d186fa47271b8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-40710

Host Header Injection HHI vulnerability in the Hotspot Shield VPN client, which can induce unexpected behaviour when accessing third-party web applications through the VPN tunnel. Although such applications do not present this vulnerability per se, the use of the tunnel, together with a forged Ho...

That Network Traffic Looks Legit, But it Could be Hiding a Serious Threat

With nearly 80% of cyber threats now mimicking legitimate user behavior, how are top SOCs determining what's legitimate traffic and what is potentially dangerous? Where do you turn when firewalls and endpoint detection and response EDR fall short at detecting the most important threats to your...

PT-2025-33808

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The get pd power uw function may experience a NULL pointer dereference when em cpu get returns NULL. This can occur when a CPU becomes unavailable during runtime, leading to a crash wh...