17000 matches found
SUSE CVE-2025-38187
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix a use-after-free in r535gsprpcpush The RPC container is released after being passed to r535gsprpcsend. When sending the initial fragment of a large RPC and passing the caller's RPC container, the container will b...
SUSE CVE-2025-38153
In the Linux kernel, the following vulnerability has been resolved: net: usb: aqc111: fix error handling of usbnet read calls Syzkaller, courtesy of syzbot, identified an error see report 1 in aqc111 driver, caused by incomplete sanitation of usb read calls' results. This problem is quite similar...
UBUNTU-CVE-2025-38186
In the Linux kernel, the following vulnerability has been resolved: bnxten: Fix double invocation of bnxtulpstop/bnxtulpstart Before the commit under the Fixes tag below, bnxtulpstop and bnxtulpstart were always invoked in pairs. After that commit, the new bnxtulprestart can be invoked after...
Qantas Confirms Major Data Breach Linked to Third-Party Vendor
Qantas has confirmed a data breach after attackers gained access through a third-party call centre platform, affecting millions…...
cpython: python: Extraction filter bypass for linking outside extraction directory
A flaw was found in CPython's tarfile module. This vulnerability allows bypassing of extraction filters, enabling symlink traversal outside the intended extraction directory and potential modification of file metadata via malicious tar archives using TarFile.extractall or TarFile.extract with the...
SUSE CVE-2025-38089
In the Linux kernel, the following vulnerability has been resolved: sunrpc: handle SVCGARBAGE during svc auth processing as auth error tianshuo han reported a remotely-triggerable crash if the client sends a kernel RPC server a specially crafted packet. If decoding the RPC reply fails in such a w...
DEBIAN-CVE-2025-38089
In the Linux kernel, the following vulnerability has been resolved: sunrpc: handle SVCGARBAGE during svc auth processing as auth error tianshuo han reported a remotely-triggerable crash if the client sends a kernel RPC server a specially crafted packet. If decoding the RPC reply fails in such a w...
A week in security (June 23 – June 29)
Last week on Malwarebytes Labs: Gmail’s multi-factor authentication bypassed by hackers to pull off targeted attacks Thousands of private camera feeds found online. Make sure yours isn’t one of them Sextortion email scammers increase their "Hello pervert" money demands Many data brokers are faili...
PT-2025-35964
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw in the pNFS block/scsi layout implementation. The issue arises from a dereference of uninitialized pointers within the ext tree free commitdata function...
PT-2025-27362
Name of the Vulnerable Software and Affected Versions Airoha Bluetooth audio SDK affected versions not specified Description A permission bypass exists in the Bluetooth LE GATT service that allows unauthorized access to critical data of the RACE protocol. This issue stems from a lack of...
CVE-2025-28993
CVE-2025-28993 concerns the WordPress plugin Content No Cache . The vulnerability is an Improper Control of Generation of Code (Code Injection) , allowing an arbitrary function call due to flaws in the plugin’s code generation logic. Affected versions are listed as up to 0.1.3 (n/a through 0.1.3)...
CVE-2025-28993 WordPress Content No Cache plugin <= 0.1.4 - Arbitrary Function Call vulnerability
Improper Control of Generation of Code 'Code Injection' vulnerability in Jose Mortellaro Content No Cache content-no-cache allows Code Injection.This issue affects Content No Cache: from n/a through = 0.1.4...
CVE-2025-36004
IBM i 7.2, 7.3, 7.4, and 7.5 could allow a user to gain elevated privileges due to an unqualified library call in IBM Facsimile Support for i. A malicious actor could cause user-controlled code to run with administrator privilege...
Why the Do Not Call Registry doesn’t work
The “Do Not Call Registry” receives a lot of hate online for failing to do its job: Stop calls. “What’s the point of being on the Do Not Call list?” wrote one user on Reddit who shared a screenshot of ten declined phone calls received across one week. Though already registered with the Do Not Cal...
CVE-2025-36004
IBM i 7.2, 7.3, 7.4, and 7.5 could allow a user to gain elevated privileges due to an unqualified library call in IBM Facsimile Support for i. A malicious actor could cause user-controlled code to run with administrator privilege...
CVE-2025-36004
IBM i 7.2, 7.3, 7.4, and 7.5 could allow a user to gain elevated privileges due to an unqualified library call in IBM Facsimile Support for i. A malicious actor could cause user-controlled code to run with administrator privilege...
CVE-2025-36004 IBM i privilege escalation
IBM i 7.2, 7.3, 7.4, and 7.5 could allow a user to gain elevated privileges due to an unqualified library call in IBM Facsimile Support for i. A malicious actor could cause user-controlled code to run with administrator privilege...
CVE-2025-36004 IBM i privilege escalation
IBM i 7.2, 7.3, 7.4, and 7.5 could allow a user to gain elevated privileges due to an unqualified library call in IBM Facsimile Support for i. A malicious actor could cause user-controlled code to run with administrator privilege...
CVE-2025-36004
CVE-2025-36004 (IBM i) affects IBM i versions 7.2–7.5 due to an unqualified library call in IBM Facsimile Support for i, enabling a user to execute code with administrator privileges (CWE-427). Base CVSS 3.1 score 8.8 (HIGH) with network attack vector, low attack complexity, and user interaction:...
CVE-2025-36004: Uncontrolled Search Path Element
IBM i 7.2, 7.3, 7.4, and 7.5 could allow a user to gain elevated privileges due to an unqualified library call in IBM Facsimile Support for i. A malicious actor could cause user-controlled code to run with administrator privilege...