ALSA-2025:18983 Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: thunderbird: firefox: Memory safety bugs CVE-2025-11714 thunderbird: firefox: Out of bounds read/write in a privileged process triggered by WebGL textures CVE-2025-11709 thunderbird: firefox: Cross-process information...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Server: Components Services component. A high privileged attacker can cause the server to hang or crash repeatedly by sending specially crafted requests over the network...

PT-2025-42966

Name of the Vulnerable Software and Affected Versions Oracle MySQL versions 8.0.0 through 8.0.43 Oracle MySQL versions 8.4.0 through 8.4.6 Oracle MySQL versions 9.0.0 through 9.4.0 Description An easily exploitable issue exists in the Server: Components Services component of MySQL Server. A...

Real-World Usability of Vulnerability Proof-Of-Concepts: A Comprehensive Study

The Proof-of-Concept PoC for a vulnerability is crucial in validating its existence, mitigating false positives, and illustrating the severity of the security threat it poses. However, research on PoCs significantly lags behind studies focusing on vulnerability data. This discrepancy can be...

Security Bulletin: IBM Security QRadar Log Management AQL Plugin includes components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. These vulnerabilities have been addressed in the update. Vulnerability Details CVEID:CVE-2025-30153 DESCRIPTION: kin-openapi is a Go project for handling OpenAPI...

October 20, 2025—KB5070773 (OS Builds 26200.6901 and 26100.6901) Out-of-band

None None...

`unic` is unmaintained

All Unicode crates that are part of https://github.com/open-i18n/rust-unic are unmaintained. Recommended alternatives - icu - idna - unicode-bidi...

RUSTSEC-2025-0079 `unic-ucd-hangul` is unmaintained

All Unicode crates that are part of https://github.com/open-i18n/rust-unic are unmaintained. Recommended alternatives - icunormalizer - unicode-normalization...

Malicious code in cp2-shared-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e522530df817242e07e68b2cb283eb4e70763b4ba8d248c97791fab28dc67887 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2025-34876

Malicious code in cp2-shared-components npm...

MAL-2025-48450 Malicious code in cp2-shared-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e522530df817242e07e68b2cb283eb4e70763b4ba8d248c97791fab28dc67887 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @vscode-bicep-ui/components (npm)

The package @vscode-bicep-ui/components was found to contain malicious code...

MAL-2025-48475 Malicious code in @vscode-bicep-ui/components (npm)

The package @vscode-bicep-ui/components was found to contain malicious code...

Microsoft Inbox COM Objects Code Execution Vulnerability (CNVD-2025-25713)

Microsoft Inbox COM Objects is a built-in COM component of the Windows operating system from the U.S. company Microsoft Microsoft. A code execution vulnerability exists in Microsoft Inbox COM Objects, which can be exploited by an attacker to execute arbitrary code...

Security Bulletin: IBM QRadar Investigation Assistant app for IBM QRadar SIEM includes components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM QRadar Investigation Assistant app for IBM QRadar SIEM has addressed the applicable CVEs Vulnerability Details CVEID:CVE-2025-58754 DESCRIPTION: Axios is a...

qrmark-logo (>=1.0.7, <=1.0.8) potentially affected by unknown CVE via components-flexibility (6.1.25)

components-flexibility NPM version 6.1.25 is affected by a known vulnerability. The following packages have a transitive dependency on components-flexibility and may be impacted: - qrmark-logo =1.0.7, =1.0.8 Source cves: unknown CVE Source advisory: SNYK:JS-COMPONENTSFLEXIBILITY-13561387...

Malicious Package

Overview components-flexibility is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

CVE-2025-58735

Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally...

CVE-2025-59282

Concurrent execution using shared resource with improper synchronization 'race condition' in Inbox COM Objects allows an unauthorized attacker to execute code locally...

EUVD-2018-21604

VestaCP commit a3f0fa1 2018-05-31 up to commit ee03eff 2018-06-13 contain embedded malicious code that resulted in a supply-chain compromise. New installations created from the compromised installer since at least May 2018 were subject to installation of Linux/ChachaDDoS, a multi-stage DDoS bot...