CVE-2025-27421 Goroutine Leak in Abacus SSE Implementation

Abacus is a highly scalable and stateless counting API. A critical goroutine leak vulnerability has been identified in the Abacus server's Server-Sent Events SSE implementation. The issue occurs when clients disconnect from the /stream endpoint, as the server fails to properly clean up resources...

CVE-2025-27421 Goroutine Leak in Abacus SSE Implementation

Abacus is a highly scalable and stateless counting API. A critical goroutine leak vulnerability has been identified in the Abacus server's Server-Sent Events SSE implementation. The issue occurs when clients disconnect from the /stream endpoint, as the server fails to properly clean up resources...

Malicious code in internallib_v488 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f37f04bf2b99a1dd9d1b1233d8d2f7146da088e20564fc4bb543560acebb10db Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-9522

Name of the Vulnerable Software and Affected Versions Abacus versions prior to 1.4.0 Description A critical issue has been identified in the Abacus server's Server-Sent Events SSE implementation, specifically with the /stream endpoint. When clients disconnect, the server fails to properly clean u...

AMD Radeon security vulnerabilities

AMD Radeon is a device driver and utility software package for Advanced Micro Devices graphics cards and GPUs from UltraMicro Semiconductor AMD. A security vulnerability exists in AMD Radeon that stems from insufficient global memory cleanup, which could result in a loss of confidentiality...

SUSE CVE-2025-21809

In the Linux kernel, the following vulnerability has been resolved: rxrpc, afs: Fix peer hash locking vs RCU callback In its address list, afs now retains pointers to and refs on one or more rxrpcpeer objects. The address list is freed under RCU and at this time, it puts the refs on those peers...

SUSE CVE-2025-21822

In the Linux kernel, the following vulnerability has been resolved: ptp: vmclock: Set driver data before its usage If vmclockptpregister fails during probing, vmclockremove is called to clean up the ptp clock and misc device. It uses devgetdrvdata to access the vmclock state. However the driver...

WordPress Plugin Templates, Next ToolKit Cross-Site Script Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A cross-site scripting...

Malicious code in tfjs-backend-webgl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 394beab3692bd8a9cc0902f84d10854738b137e336a125a3be59345d8e13f284 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in golanci-lint-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e69962c9a060f9d61253d944cc7c3573debc57053555bb4dd496618bc1b6510f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

OESA-2025-1203 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmode should keep reference to parent The altmode device release refers to its parent device, but without keeping a reference to it. When registeri...

SUSE CVE-2024-57975

In the Linux kernel, the following vulnerability has been resolved: btrfs: do proper folio cleanup when rundelallocnocow failed BUG With CONFIGDEBUGVM set, test case generic/476 has some chance to crash with the following VMBUGONFOLIO: BTRFS error device dm-3: cowfilerange failed, start 1146880 e...

SUSE CVE-2024-57992

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: unregister wiphy only if it has been registered There is a specific error path in probe functions in wilc drivers both sdio and spi which can lead to kernel panic, as this one for example when using SPI: Unable to...

SUSE CVE-2024-58002

In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Remove dangling pointers When an async control is written, we copy a pointer to the file handle that started the operation. That pointer will be used when the device is done. Which could be anytime in the future...

SUSE CVE-2025-21739

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix use-after free in init error and remove paths devmblkcryptoprofileinit registers a cleanup handler to run when the associated platform- device is being released. For UFS, the crypto private data and pointers...

WordPress plugin Site Mailer – SMTP replacement, email API deliverability, and email logging; cross-site scripting vulnerabilities

WordPress and WordPress plugin are products of the WordPress Foundation, a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. WordPress plugin Site Mailer - SMTP Replacement, Email API Deliverabili...

WordPress plugin SecuPress Free: Cross-site scripting vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin contest gallery cross-site scripting vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in...

WordPress plugin Cardealer security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

Setup Files Cleanup Privilege Exploitation

The vulnerability of the Setup Files Cleanup component of the Windows operating system is related to errors in handling symbolic links. Exploiting this vulnerability can allow an attacker to increase their privileges...