Malicious code in scrt-www (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c3dc483e4a4005db4d3a5ec2f2b2e8d63aa5b8258510f483ce9d4c7351b2c84 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-18219

Name of the Vulnerable Software and Affected Versions AirPlay audio SDK versions 2.7.1 and later AirPlay video SDK versions 3.6.0.126 and later CarPlay Communication Plug-in version R18.1 and later Description This issue involves improved memory handling to address a flaw that could allow a local...

About the security content of AirPlay audio SDK 2.7.1, AirPlay video SDK 3.6.0.126, and CarPlay Communication Plug-in R18.1 Updates

About the security content of AirPlay audio SDK 2.7.1, AirPlay video SDK 3.6.0.126, and CarPlay Communication Plug-in R18.1 Updates This document is intended for developers of accessories or software compatible with Apple devices. These updates are available for members of the Apple MFi Program...

An error occurs when specifying the license server by IP address in Citrix Studio

In Citrix Studio, select Licensing from the left-hand tree and click Change License Server, when entering IP address in the "Change License Server" window that appears, the message "Connected to a trusted server" is displayed. However, when returning to Studio, the error message "Cannot connect t...

Malicious code in r5-zknet-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 070dfd4d90ed4eb9d2cd623b84d76f1b2cf1fcfd6bb9704350773e5344446c94 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3085 Malicious code in @harvest-finance/harvest-strategy-polygon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware de49a90e4d6b1a88dee0473346a18e2f27d007f4bc260eb2d2b9dbcf0f12cbed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-22278

Name of the Vulnerable Software and Affected Versions vLLM versions 0.6.5 through 0.8.4 Description vLLM, an inference and serving engine for large language models LLMs, contains a remote code execution issue. This impacts environments utilizing the PyNcclPipe KV cache transfer integration with t...

MAL-2025-3029 Malicious code in @piplabs/story-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis aea8fd9cbbb537c9ab8c18ec64d632639595d5b9fe604d9a9b9d0313bda114fc The OpenSSF Package Analysis project identified '@piplabs/story-contracts' @ 0.1.0-alpha.1 npm as malicious. It is considered malicious because:...

CVE-2025-30356

CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures SDLS-EP to secure communications between a spacecraft running the core Flight System cFS and a ground station. In 1.3.3 and earlier, a heap buffer overflow vulnerability persists in...

CVE-2025-30356 Heap Buffer Overflow via Incomplete Length Check in `Crypto_TC_ApplySecurity`

CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures SDLS-EP to secure communications between a spacecraft running the core Flight System cFS and a ground station. In 1.3.3 and earlier, a heap buffer overflow vulnerability persists in...

CVE-2025-21930

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: don't try to talk to a dead firmware This fixes: bad state = 0 WARNING: CPU: 10 PID: 702 at drivers/net/wireless/inel/iwlwifi/iwl-trans.c:178 iwltranssendcmd+0xba/0xe0 iwlwifi Call Trace: ? warn+0xca/0x1c0 ?...

UBUNTU-CVE-2025-21947

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix type confusion via race condition when using ipcmsgsendrequest req-handle is allocated using ksmbdacquireid&ipcida, based on idaalloc. req-handle from ksmbdipcloginrequest and FSCTLPIPETRANSCEIVE ioctl can be same and ...

CVE-2025-21947 ksmbd: fix type confusion via race condition when using ipc_msg_send_request

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix type confusion via race condition when using ipcmsgsendrequest req-handle is allocated using ksmbdacquireid&ipcida, based on idaalloc. req-handle from ksmbdipcloginrequest and FSCTLPIPETRANSCEIVE ioctl can be same and ...

CVE-2025-21930

CVE-2025-21930 affects the Linux kernel wireless subsystem (iwlwifi/mvm). The vulnerability arises when the driver talks to firmware that may be dead; before sending a command it now checks that the firmware is alive, preventing commands on an unresponsive firmware. Impact: local attacker could c...

CVE-2025-21930 wifi: iwlwifi: mvm: don't try to talk to a dead firmware

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: don't try to talk to a dead firmware This fixes: bad state = 0 WARNING: CPU: 10 PID: 702 at drivers/net/wireless/inel/iwlwifi/iwl-trans.c:178 iwltranssendcmd+0xba/0xe0 iwlwifi Call Trace: ? warn+0xca/0x1c0 ?...

CVE-2025-21930

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: don't try to talk to a dead firmware This fixes: bad state = 0 WARNING: CPU: 10 PID: 702 at drivers/net/wireless/inel/iwlwifi/iwl-trans.c:178 iwltranssendcmd+0xba/0xe0 iwlwifi Call Trace: ? warn+0xca/0x1c0 ?...

Lucid PhaaS Hits 169 Targets in 88 Countries Using iMessage and RCS Smishing

A new sophisticated phishing-as-a-service PhaaS platform called Lucid has targeted 169 entities in 88 countries using smishing messages propagated via Apple iMessage and Rich Communication Services RCS for Android. Lucid's unique selling point lies in its weaponizing of legitimate communication...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an attempt to communicate with dead firmware...

The vulnerability of the digital_in_send_sdd_req() function in the net/nfc/digital_technology.c module of the NFC subsystem of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the digitalinsendsddreq function in the net/nfc/digitaltechnology.c module of the NFC subsystem of the Linux operating system is related to improper memory release before deleting the last pointer memory leak. Exploiting this vulnerability could allow an attacker to cause a...

The vulnerability of the SAP Web Dispatcher web dispatcher and the SAP NetWeaver Internet Communication Manager web application servers involves the disclosure of password values in log files, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the SAP Web Dispatcher web dispatcher and the SAP NetWeaver Internet Communication Manager web application servers relates to the disclosure of password values in log files. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized...