CVE-2025-39894

The CVE-2025-39894 issue is in the Linux kernel netfilter br_netfilter path: br_nf_local_in() confirms conntrack during handling of a broadcast to a tap device added to a bridge. If another conntrack with the same hash is added, a warning can be emitted. The root cause is br_nf_local_in() using t...

CVE-2025-39894 netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm

In the Linux kernel, the following vulnerability has been resolved: netfilter: brnetfilter: do not check confirmed bit in brnflocalin after confirm When send a broadcast packet to a tap device, which was added to a bridge, brnflocalin is called to confirm the conntrack. If another conntrack with...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a security vulnerability that stems from not properly validating cached keys for link metadata, which could lead to an authenticated user accessing unauthorized posts and...

PT-2025-40068

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.17.0-rc2-dirty 44 Description The Linux kernel contains an issue within the netfilter module, specifically in the br netfilter component. A hash collision can occur when handling broadcast packets sent to a...

CVE-2025-38677

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid out-of-boundary access in dnode page As Jiaming Zhang reported: dumpstack lib/dumpstack.c:94 inline dumpstacklvl+0x1c1/0x2a0 lib/dumpstack.c:120 printaddressdescription mm/kasan/report.c:378 inline...

Linux Distros Unpatched Vulnerability : CVE-2025-4404

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the...

Linux Distros Unpatched Vulnerability : CVE-2015-1230

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The getHiddenProperty function in bindings/core/v8/V8EventListenerList.h in Blink, as used in Google Chrome before 41.0.2272.76, has a name conflict with the...

Malicious code in @malware-test-tapet-genus-demob-clash/test-mlw3-tapet-genus-demob-clash (npm)

The package @malware-test-tapet-genus-demob-clash/test-mlw3-tapet-genus-demob-clash was found to contain malicious code...

MAL-2025-9036 Malicious code in @malware-test-unaus-conky-caxon-clash/test-mlw3-unaus-conky-caxon-clash (npm)

The package @malware-test-unaus-conky-caxon-clash/test-mlw3-unaus-conky-caxon-clash was found to contain malicious code...

MAL-2025-8991 Malicious code in @malware-test-tapet-genus-demob-clash/test-mlw3-tapet-genus-demob-clash (npm)

The package @malware-test-tapet-genus-demob-clash/test-mlw3-tapet-genus-demob-clash was found to contain malicious code...

Fedora: Security Advisory (FEDORA-2025-b4a1689983)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 42 : clash-meta (2025-b4a1689983)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-b4a1689983 advisory. upgrade to 1.19.12 Mitigating remote code execution vulnerabilities using systemd sandboxing features. Tenable has extracted the preceding description block...

[SECURITY] Fedora 42 Update: clash-meta-1.19.12-1.fc42

A rule based network proxy tool, also be known as mihomo...

PT-2025-35350

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel's f2fs implementation related to out-of-boundary access in dnode pages. The issue stems from a corrupted image where a dnode shares a node ID with its...

CVE-2023-24205

Clash for Windows v0.20.12 was discovered to contain a remote code execution RCE vulnerability which is exploited via overwriting the configuration file cfw-setting.yaml...

CVE-2023-30541

OpenZeppelin Contracts is a library for secure smart contract development. A function in the implementation contract may be inaccessible if its selector clashes with one of the proxy's own selectors. Specifically, if the clashing function has a different signature with incompatible ABI encoding,...

CVE-2022-42519

In CdmaBroadcastSmsConfigsRequestData::encode of cdmasmsdata.cpp, there is a possible stack clash leading to memory corruption. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Andro...

CVE-2022-40126

A misconfiguration in the Service Mode profile directory of Clash for Windows v0.19.9 allows attackers to escalate privileges and execute arbitrary commands when Service Mode is activated...

CVE-2022-20578

In RadioImpl::setGsmBroadcastConfig of rilservicelegacy.cpp, there is a possible stack clash leading to memory corruption. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android...

CVE-2022-20579

In RadioImpl::setCdmaBroadcastConfig of rilservicelegacy.cpp, there is a possible stack clash leading to memory corruption. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android...