Siemens SIMATIC S7-1500 Use After Free (CVE-2024-56600)

net: inet6: do not leave a dangling sk pointer in inet6create sockinitdata attaches the allocated sk pointer to the provided sock object. If inet6create fails later, the sk object is released, but the sock object retains the dangling sk pointer, which may cause use-after-free later. Clear the soc...

PT-2025-46823

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.1 PostgreSQL versions prior to 17.7 PostgreSQL versions prior to 16.11 PostgreSQL versions prior to 15.15 PostgreSQL versions prior to 14.20 PostgreSQL versions prior to 13.23 Description A flaw exists in the...

PostgreSQL 安全漏洞

PostgreSQL is a free object-relational database management system from the PostgreSQL organization. The system supports most of the SQL standards and provides many other features such as foreign keys, triggers, views, and more. A security vulnerability exists in PostgreSQL that stems from a lack ...

Vulnerability in core server (CVE-2025-12817)

PostgreSQL CREATE STATISTICS does not check for schema CREATE privilege Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, fro...

Siemens SIMATIC S7-1500 Use After Free (CVE-2024-56601)

In the Linux kernel, the following vulnerability has been resolved: net: inet: do not leave a dangling sk pointer in inetcreate sockinitdata attaches the allocated sk object to the provided sock object. If inetcreate fails later, the sk object is freed, but the sock object retains the dangling...

Malicious code in sahufarf-satidafa-farirataf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0845bba33f72ba75cbb0e312da5ed28d652d6dfb437f9d2439d83c9da2ef582b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-175410 Malicious code in kapvino-soni-favavri (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db44ee698778602551881e4f3c4b26d6bef6082dcf779f2f8af6b14e782b3484 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-152984 Malicious code in astia-aldofa-mafgusdfkoli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7d444e537ccd79d078cc8136a81a7dda71fa732738db5cba1511fcdb047ddb4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-124951

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: sofsdw: Prevent jump to NULL addsidecar callback In createsdwdailink check that sofend-codecinfo-addsidecar is not NULL before calling it. The original code assumed that if includesidecar is true, the codec on that...

CVE-2025-40132

CVE-2025-40132 (Linux kernel, ASoC Intel sof_sdw) : The issue arises in create_sdw_dailink() when calling add_sidecar callbacks on links that may contain codecs without an add_sidecar callback. The patch adds a NULL check for sof_end->codec_info->add_sidecar before invocation to prevent der...

Malicious code in init-bootes-radiant-aether (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 050a045bc10e41c3926121ea922e01fa47baa0f522d718879a886b21ba3357bd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990800)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990800 advisory. In the Linux kernel, the following vulnerability has been resolved: drbd: use after free in drbdcreatedevice The drbddestroyconnection frees the connection so use th...

Malicious code in dewanto-ronde24-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1a6ebff09d28763b757cf21d483de1fc81adc62632f1529cc9d9bcbb33213d7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-120243 Malicious code in gilang-kue69-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 213a79ccb7b5c76733d07d641dbb6d2887cdafee55a3dc8012b40dc5ea14f126 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-107787 Malicious code in recent_bird_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53a9337f9db6a80d12d843dc8dbb3d4155e06e8c6221f0e089f815a90c3deb64 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-85518 Malicious code in fauzi-kupat89-sumpek (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3cff856a1bbc1d7e7eddbb70f7376d6ec01dd575317d9d755d3a8394d675fd78 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in putri-nasi51-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6a4a237e86e60effb3593bdcb0349065e9938e7e5789c6e16fc396d4d6fb436 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-62756 Malicious code in erick-empal86-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 970dff4e76c589dbd5bf39d924a0a4d927ad56c53c4f6d77bc8d3a9aec5fef9c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Medium: fontforge

Issue Overview: FontForge v20230101 was discovered to contain a memory leak via the component DlgCreate8. CVE-2025-50949 Affected Packages: fontforge Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras...

CVE-2025-12621

The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on the 'createrefund' function in all versions up to, and including, 1.0.42. This makes it possible for authenticated attackers, wit...