microcode_ctl: From CVEorg collector

Incorrect behavior order for some IntelR Core™ Ultra Processors may allow an unauthenticated user to potentially enable information disclosure via physical access...

microcode_ctl: From CVEorg collector

Incorrect behavior order for some IntelR Core™ Ultra Processors may allow an unauthenticated user to potentially enable information disclosure via physical access...

SUSE-RU-2025:20460-1 Recommended update for gpg2

This update for gpg2 fixes the following issues: This reverts the CVE-2025-30258 fix, as it changed behaviour when using expired keys...

CVE-2025-40710 Host Header Injection (HHI) in the Hotspot Shield VPN client

Host Header Injection HHI vulnerability in the Hotspot Shield VPN client, which can induce unexpected behaviour when accessing third-party web applications through the VPN tunnel. Although such applications do not present this vulnerability per se, the use of the tunnel, together with a forged Ho...

CVE-2025-40710

CVE-2025-40710 pertains to a Host Header Injection (HHI) in the Hotspot Shield VPN client. The vulnerability arises from how the VPN client internally handles outgoing headers and requests, allowing a forged Host header to influence traffic routing through the VPN tunnel. Reported impacts include...

Malicious code in titan-exchange-shared (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bcbcec353cd72f56bcc238f2996606b61523a85e851d694e96012a54c027f606 Any computer that has this package installed or running should be considered...

MAL-2025-5330 Malicious code in titan-exchange-shared (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bcbcec353cd72f56bcc238f2996606b61523a85e851d694e96012a54c027f606 Any computer that has this package installed or running should be considered...

MAL-2025-5314 Malicious code in puppetexplorer (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0ab86acd07919fde349edfeff50f7013fc28b45b00cbf8537a1f33ef5fa4d284 Any computer that has this package installed or running should be considered...

CVE-2025-38085 mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix hugepmdunshare vs GUP-fast race hugepmdunshare drops a reference on a page table that may have previously been shared across processes, potentially turning it into a normal page table used in another process in...

Fedora 42 : webkitgtk (2025-40aeebe6d2)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-40aeebe6d2 advisory. Enable CSS Overscroll Behavior by default. Change threaded rendering implementation to use Skia API instead of WebCore display list that is not thre...

OESA-2025-1692 firefox security update

Mozilla Firefox is a standalone web browser, designed for standards compliance and performance. Its functionality can be enhanced via a plethora of extensions. Security Fixes: The ShmemCharMapHashEntry code was susceptible to potentially undefined behavior by bypassing the move semantics for one ...

OESA-2025-1691 firefox security update

Mozilla Firefox is a standalone web browser, designed for standards compliance and performance. Its functionality can be enhanced via a plethora of extensions. Security Fixes: The ShmemCharMapHashEntry code was susceptible to potentially undefined behavior by bypassing the move semantics for one ...

CVE-2025-45333

berkeley-abc abc 1.1 contains a Null Pointer Dereference NPD vulnerability in the AbcNtkCecFraigPart function of its data processing module, leading to unpredictable program behavior, causing segmentation faults, and program crashes...

MAL-2025-5277 Malicious code in robinhood-internal-utils (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5350c4af558b6036e996982e7ac060be1ac0516b91dfd7b983a5c0b5d76270ec The OpenSSF Package Analysis project identified...

CVE-2025-6706 Running certain aggregation operations with the SBE engine may lead to unexpected behavior on MongoDB Server

An authenticated user may trigger a use after free that may result in MongoDB Server crash and other unexpected behavior, even if the user does not have authorization to shut down a server. The crash is triggered on affected versions by issuing an aggregation framework operation using a specific...

CVE-2025-6706 Running certain aggregation operations with the SBE engine may lead to unexpected behavior on MongoDB Server

An authenticated user may trigger a use after free that may result in MongoDB Server crash and other unexpected behavior, even if the user does not have authorization to shut down a server. The crash is triggered on affected versions by issuing an aggregation framework operation using a specific...

SUSE-SU-2025:02120-1 Security update for go1.24-openssl

This update for go1.24-openssl fixes the following issues: Update to version 1.24.4 bsc1236217: - CVE-2025-22874 crypto/x509: ExtKeyUsageAny bypasses policy validation bsc1244158. - CVE-2025-0913 os: inconsistent handling of OCREATE|OEXCL on Unix and Windows bsc1244157. - CVE-2025-4673 net/http:...

Malicious code in justeat-storybook (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 577d8ffd11e5da3a5000b8a390c45c8474d2dd362e509a65a107f2b0df13e563 The OpenSSF Package Analysis project identified 'justeat-storybook' @ 1.0.3 npm as malicious. It is considered malicious because: - The package...

MAL-2025-5274 Malicious code in testetedep (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 20ba1fe5405430542f5bc80c76eed797af680bbe6ccc3df0ddefbb7a8ebaeab4 Any computer that has this package installed or running should be considered...

CVE-2025-52576

Kanboard prior to version 1.2.46 is vulnerable to username enumeration and IP spoofing–based brute-force protection bypass. By analyzing login behavior and abusing trusted HTTP headers, an attacker can enumerate valid usernames and bypass rate-limiting or IP-based blocking mechanisms, increasing ...