CVE-2025-14819

When doing TLS related transfers with reused easy or multi handles and altering the CURLSSLOPTNOPARTIALCHAIN option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcur...

UBUNTU-CVE-2025-14819

When doing TLS related transfers with reused easy or multi handles and altering the CURLSSLOPTNOPARTIALCHAIN option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcur...

12306-adk-mcp (0.3.4), 12306-mcp (>=0.3.3, <=0.3.10) +2008 more potentially affected by CVE-2026-0621 via @modelcontextprotocol/sdk (>=1.3.0, <=1.25.1)

@modelcontextprotocol/sdk NPM version =1.3.0, =0.3.3, =1.0.0, =0.1.0, =1.14.1, =1.0.0, =1.2.1, =0.1.4, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.1, =0.0.1, =0.0.2, =1.0.0, =1.0.19 and more Source cves: CVE-2026-0621 Source advisory: SNYK:JS-MODELCONTEXTPROTOCOLSDK-14871802...

12306-adk-mcp (0.3.4), 12306-mcp (>=0.3.3, <=0.3.10) +2008 more potentially affected by CVE-2026-0621 via @modelcontextprotocol/sdk (>=1.3.0, <=1.25.1)

@modelcontextprotocol/sdk NPM version =1.3.0, =0.3.3, =1.0.0, =0.1.0, =1.14.1, =1.0.0, =1.2.1, =0.1.4, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.1, =0.0.1, =0.0.2, =1.0.0, =1.0.19 and more Source cves: CVE-2026-0621 Source advisory: OSV:GHSA-8R9Q-7V3J-JR4G...

FoolishScan

Foolish Scan v2.3 Gold Master Context-Aware CTF & Lab Re...

SecLeak

SecLeak Assessment This repository contains the s...

EUVD-2026-0812

Mega-Fence webgate-lib. 25.1.914 and prior trusts the first value of the X-Forwarded-For XFF header as the client IP without validating a trusted proxy chain. An attacker can supply an arbitrary XFF value in a remote request to spoof the client IP, which is then propagated to security-relevant...

Amazon Linux 2 : docker, --advisory ALAS2DOCKER-2025-089 (ALASDOCKER-2025-089)

The version of docker installed on the remote host is prior to 25.0.13-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2025-089 advisory. crypto/x509: excluded subdomain constraint does not restrict wildcard SANs An excluded subdomain constraint in a certificate...

CVE-2025-65328

CVE-2025-65328 affects Mega-Fence (webgate-lib.*) 25.1.914 and earlier. The component trusts the first value of the X-Forwarded-For header as the client IP without validating a trusted proxy chain, enabling an attacker to spoof the client IP via XFF in remote requests. This spoofed IP can propaga...

CVE-2025-11157

A high-severity remote code execution vulnerability exists in feast-dev/feast version 0.53.0, specifically in the Kubernetes materializer job located at feast/sdk/python/feast/infra/computeengines/kubernetes/main.py. The vulnerability arises from the use of yaml.load..., Loader=yaml.Loader to...

PT-2026-2950

Name of the Vulnerable Software and Affected Versions Undici versions prior to 7.18.0 Undici versions prior to 6.23.0 Description Undici is an HTTP/1.1 client for Node.js. A malicious server can insert thousands of compression steps due to an unbounded number of links in the decompression chain a...

Trust Wallet Chrome Extension Hack Drains $8.5M via Shai-Hulud Supply Chain Attack

Trust Wallet on Tuesday revealed that the second iteration of the Shai-Hulud aka Sha1-Hulud supply chain outbreak in November 2025 was likely responsible for the hack of its Google Chrome extension, ultimately resulting in the theft of approximately $8.5 million in assets. "Our Developer GitHub...

WordPress Pixter Right Click Protect Images for WordPress plugin <= 1.2 - Supply Chain Compromise vulnerability

Supply Chain Compromise vulnerability discovered by Mike Gozdiskowski in WordPress Plugin Pixter Right Click Protect Images for WordPress versions = 1.2...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992975)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992975 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: do not allow CHAINID to refer to another table When doing lookups for chains...

WordPress Image License and Protection plugin <= 1.0 - Supply Chain Compromise vulnerability

Supply Chain Compromise vulnerability discovered by Mike Gozdiskowski in WordPress Plugin Image License and Protection versions = 1.0...

EUVD-2022-55848

In the Linux kernel, the following vulnerability has been resolved: scsi: ipr: Fix WARNING in iprinit iprinit will not call unregisterrebootnotifier when pciregisterdriver fails, which causes a WARNING. Call unregisterrebootnotifier when pciregisterdriver fails. notifier callback iprhalt ipr...

GHSA-RRXM-2PVV-M66X Picklescan is vulnerable to RCE via missing detection when calling numpy.f2py.crackfortran.getlincoef

Summary Picklescan uses the numpy.f2py.crackfortran.getlincoef function a NumPy F2PY helper to execute arbitrary Python code during unpickling. Details Picklescan fails to detect a malicious pickle that uses the gadget numpy.f2py.crackfortran.getlincoef in reduce, allowing arbitrary command...

Picklescan is vulnerable to RCE via missing detection when calling numpy.f2py.crackfortran.getlincoef

Summary Picklescan uses the numpy.f2py.crackfortran.getlincoef function a NumPy F2PY helper to execute arbitrary Python code during unpickling. Details Picklescan fails to detect a malicious pickle that uses the gadget numpy.f2py.crackfortran.getlincoef in reduce, allowing arbitrary command...

CVE-2022-50850 scsi: ipr: Fix WARNING in ipr_init()

In the Linux kernel, the following vulnerability has been resolved: scsi: ipr: Fix WARNING in iprinit iprinit will not call unregisterrebootnotifier when pciregisterdriver fails, which causes a WARNING. Call unregisterrebootnotifier when pciregisterdriver fails. notifier callback iprhalt ipr...

OESA-2025-2884 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Apply the link chain quirk on NEC isoc endpoints Two clearly different specimens of NEC uPD720200 one with start/stop bug, one without were seen to...