MAL-2026-11042 Malicious code in faust-cont (npm)

The npm package faust-cont is a supply-chain dropper disguised as a benign CLI tool index.js is a decoy that only logs "cli tool install package loaded". The real behaviour is placed in an install script. An install lifecycle hook install: node install.js executes automatically on npm install,...

kernel: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()

QLogic qede driver processes TPA TCP/IP Packet Aggregation completion queue entries by iterating through lenlist until hitting a zero terminator. Malformed or corrupted completion entries lacking this sentinel cause the loop to read beyond array bounds. SVACE static analysis identified that...

kernel: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()

QLogic qede driver processes TPA TCP/IP Packet Aggregation completion queue entries by iterating through lenlist until hitting a zero terminator. Malformed or corrupted completion entries lacking this sentinel cause the loop to read beyond array bounds. SVACE static analysis identified that...

CVE-2025-40252

QLogic qede driver processes TPA TCP/IP Packet Aggregation completion queue entries by iterating through lenlist until hitting a zero terminator. Malformed or corrupted completion entries lacking this sentinel cause the loop to read beyond array bounds. SVACE static analysis identified that...

btrfs: set_page_extent_mapped after read_folio in btrfs_cont_expand

...

CVE-2025-40252 net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()

In the Linux kernel, the following vulnerability has been resolved: net: qlogic/qede: fix potential out-of-bounds read in qedetpacont and qedetpaend The loops in 'qedetpacont' and 'qedetpaend', iterate over 'cqe-lenlist' using only a zero-length terminator as the stopping condition. If the...

EUVD-2025-201205

In the Linux kernel, the following vulnerability has been resolved: net: qlogic/qede: fix potential out-of-bounds read in qedetpacont and qedetpaend The loops in 'qedetpacont' and 'qedetpaend', iterate over 'cqe-lenlist' using only a zero-length terminator as the stopping condition. If the...

CVE-2025-40252 net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()

In the Linux kernel, the following vulnerability has been resolved: net: qlogic/qede: fix potential out-of-bounds read in qedetpacont and qedetpaend The loops in 'qedetpacont' and 'qedetpaend', iterate over 'cqe-lenlist' using only a zero-length terminator as the stopping condition. If the...

CVE-2025-9557

CVE-2025-9557 is documented as a Bluetooth Mesh vulnerability: an out-of-bounds write in gen_prov_cont can enable arbitrary code execution, or cause a crash and DoS on Zephyr-based devices. Affected: Zephyr RTOS Bluetooth Mesh components; root cause is an out-of-bound write. Exploitation status i...

CVE-2025-9557 Bluetooth: Mesh: Out-of-Bound Write in gen_prov_cont

‭An out-of-bound write can lead to an arbitrary code execution. Even on devices with some form of memory protection, this can still lead to‬ ‭a crash and a resultant denial of service.‬...

CVE-2025-41348

SQL injection vulnerability in WinPlus v24.11.27 by Informática del Este. This vulnerability allows an attacker recover, create, update an delete databases by sendng a POST request using the parameters 'val1' and 'cont in '/WinplusPortal/ws/sWinplus.svc/json/getacumperpost'...

Informática del Este WinPlus SQL注入漏洞

Informática del Este WinPlus is a human resource management platform from the Spanish company Informática del Este. An SQL injection vulnerability exists in Informática del Este WinPlus version v24.11.27, which stems from insufficient cleanup and escaping of the parameters val1 and cont, which...

CVE-2025-41348: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in WinPlus v24.11.27 by Informática del Este. This vulnerability allows an attacker recover, create, update an delete databases by sendng a POST request using the parameters 'val1' and 'cont in '/WinplusPortal/ws/sWinplus.svc/json/getacumperpost'...

CVE-2023-53247

In the Linux kernel, the following vulnerability has been resolved: btrfs: setpageextentmapped after readfolio in btrfscontexpand While trying to get the subpage blocksize tests running, I hit the following panic on generic/476 assertion failed: PagePrivatepage && page-private, in...

CVE-2023-53247 btrfs: set_page_extent_mapped after read_folio in btrfs_cont_expand

In the Linux kernel, the following vulnerability has been resolved: btrfs: setpageextentmapped after readfolio in btrfscontexpand While trying to get the subpage blocksize tests running, I hit the following panic on generic/476 assertion failed: PagePrivatepage && page-private, in...

CVE-2023-53247 btrfs: set_page_extent_mapped after read_folio in btrfs_cont_expand

In the Linux kernel, the following vulnerability has been resolved: btrfs: setpageextentmapped after readfolio in btrfscontexpand While trying to get the subpage blocksize tests running, I hit the following panic on generic/476 assertion failed: PagePrivatepage && page-private, in...

CVE-2023-53247 btrfs: set_page_extent_mapped after read_folio in btrfs_cont_expand

In the Linux kernel, the following vulnerability has been resolved: btrfs: setpageextentmapped after readfolio in btrfscontexpand While trying to get the subpage blocksize tests running, I hit the following panic on generic/476 assertion failed: PagePrivatepage && page-private, in...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a page extension mapping not being set correctly in the btrfscontexpand function, which could lead to an...

MAL-2025-11002 Malicious code in @zalastax/nolb-cont8 (npm)

The package @zalastax/nolb-cont8 was found to contain malicious code...

RSSHub 输入验证错误漏洞

RSSHub is the world's largest RSS network open-sourced by DIYgod, consisting of over 5000 global instances. RSSHub suffers from an input validation error vulnerability that stems from the vulnerability of RSSHub's docker-test-cont.yml workflow to a poisoning attack, which could lead to a takeover...