CVE-2021-44678

An issue 2 of 6 was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the Enterprise Vault application starts several services that listen on random .NET Remoting TCP ports for possible commands from client applications. These TCP services can be exploited due to deserialization...

CVE-2022-23562

Tensorflow is an Open Source Machine Learning Framework. The implementation of Range suffers from integer overflows. These can trigger undefined behavior or, in some scenarios, extremely large allocations. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on...

CVE-2020-6296

SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 753, 755, allows an attacker to inject code that can be executed by the application, leading to Code Injection. An attacker could thereby control the behavior of the application...

DEBIAN-CVE-2023-52925

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: don't fail inserts if duplicate has expired nftables selftests fail: run-tests.sh testcases/sets/0044intervaloverlap0 Expected: 0-2 . 0-3, got: W: FAILED ./testcases/sets/0044intervaloverlap0: got 1 Insertion...

Security Bulletin: IBM Instana Observability is vulnerable to Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip

Summary A vulnerability that could cause unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip was remediated in IBM Observability with Instana Build 289 CVE-2024-24790. The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6...

CVE-2024-24563

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. Arrays can be keyed by a signed integer, while they are defined for unsigned integers only. The typechecker doesn't throw when spotting the usage of an int as an index for an array. The typechecker allows the usage of...

CVE-2025-24959

zx is a tool for writing better scripts. An attacker with control over environment variable values can inject unintended environment variables into process.env. This can lead to arbitrary command execution or unexpected behavior in applications that rely on environment variables for...

SUSE-SU-2025:20094-1 Security update for python-requests

This update for python-requests contains the following fixes: - Add patch to fix to inject the default CA bundles if they are not specified. bsc1226321, bsc1231500 - Remove Requires on python-py, it should have been removed earlier. - update to 2.32.3: Fixed bug breaking the ability to specify...

SUSE-SU-2025:20034-1 Security update for python-requests

This update for python-requests fixes the following issues: - Update to 2.32.2 To provide a more stable migration for custom HTTPAdapters impacted by the CVE changes in 2.32.0, we've renamed getconnection to a new public API, getconnectionwithtlscontext. Existing custom HTTPAdapters will need to...

MAL-2025-725 Malicious code in victory-native-xl-monorepo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9101dd18b0880eb5358d74e5a997f3a532b49825b6a4cb47d96778143a48b4a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

AZL-56406 CVE-2025-21680 affecting package kernel for versions less than 5.15.180.1-1

In the Linux kernel, the following vulnerability has been resolved: pktgen: Avoid out-of-bounds access in getimixentries Passing a sufficient amount of imix entries leads to invalid access to the pktdev-imixentries array because of the incorrect boundary check. UBSAN: array-index-out-of-bounds in...

Google Rejection Page Text Injection

Google's unusual traffic activity page appears to allow for text injection but cross site scripting is mitigated. The page https://www.google.com/sorry/index is familiar to Tor and VPN users. It is the one that says "Our systems have detected unusual traffic from your computer network. Please try...

vdpa: solidrun: Fix UB bug with devres

...

MAL-2025-604 Malicious code in intel-enterprise-rag-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 30b1b0912b61e57e7e0c1b76442cf9f5894447f876e8098c0efb67c72e1dc52f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bindbc-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3969ce36d361753fe46f849a0dba26b4548e7c90bec80c86390c47bb429ec9bf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-587 Malicious code in swift-login-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dbad853440515e1762a39bb7b7d5a115b77cf243fd0ee0b3bbd82c1ac8bab0c0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-349 Malicious code in chkpkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2abd5e119e59d609551d6fcaf5128bad86491c26cc6b721014c324d54e930a7e The OpenSSF Package Analysis project identified 'chkpkit' @ 99.99.9-9.99 npm as malicious. It is considered malicious because: - The package...

MAL-2025-326 Malicious code in bigcommerce.github.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f610f94d4adf4f1e09e9727a8c6960c6b9c0bef8733be71242a3bfdad135f55 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-324 Malicious code in built-with-workers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f426ea9ad545f39f1e84cd26ee384b096d08c2b82f8b3554f97fc1ce85fac83 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Discover Hidden Browsing Threats: Free Risk Assessment for GenAI, Identity, Web, and SaaS Risks

As GenAI tools and SaaS platforms become a staple component in the employee toolkit, the risks associated with data exposure, identity vulnerabilities, and unmonitored browsing behavior have skyrocketed. Forward-thinking security teams are looking for security controls and strategies to address...