LSN-0116-1: Kernel Live Patch Security Notice

In the Linux kernel, the following vulnerability has been resolved: net: atlantic: eliminate double free in error handling logic Driver has a logic leak in ring data allocation/free, where aqringfree could be called multiple times on same ring, if system is under stress and got memory allocation...

GHSA-JJ37-3377-M6VV Duplicate Advisory: Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mm7p-fcc7-pg87. This link is maintained to preserve external references. Original Description A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient...

UBUNTU-CVE-2025-13033

A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit this flaw by crafting a recipient address that embeds an external address within quotes. This causes the application to misdirect the emai...

CVE-2025-13033 Nodemailer: nodemailer: email to an unintended domain can occur due to interpretation conflict

A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit this flaw by crafting a recipient address that embeds an external address within quotes. This causes the application to misdirect the emai...

SourceCodester Simple Online Book Store System 安全漏洞

SourceCodester Simple Online Book Store System is a SourceCodester open source simple online bookstore system. A security vulnerability exists in SourceCodester Simple Online Book Store System, which originates from an unauthenticated HTTP GET request to access a database backup file, potentially...

Nodemailer 安全漏洞

Nodemailer is a JS codebase from the Nodemailer team that uses a JS codebase that provides the ability to send emails. A security vulnerability exists in Nodemailer that stems from mishandling of the email parsing library, which could result in emails being misdirected to an attacker's address,...

Unleashing the Kraken ransomware group

In August 2025, Cisco Talos observed big-game hunting and double extortion attacks carried out by Kraken, a Russian-speaking group that has emerged from the remnants of the HelloKitty ransomware cartel. Talos observed in one intrusion that the Kraken actor exploited Server Message Block SMB...

Siemens SIMATIC and SCALANCE Improper Input Validation (CVE-2024-7264)

libcurl's ASN1 parser code has the GTime2str function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the time fraction, leading to a strlen getting performed on a pointer to a heap buffer area that i...

Siemens SIMATIC S7-1500 Use of Uninitialized Resource (CVE-2021-22925)

curl supports the -t command line option, known as CURLOPTTELNETOPTIONSin libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending NEWENV variables, libcurlcould be made to pass on uninitialized data from a stack based...

EulerOS 2.0 SP10 : coreutils (EulerOS-SA-2025-2409)

According to the versions of the coreutils package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in GNU Coreutils. The sort utility's begfield function is vulnerable to a heap buffer under-read. The program may access memory...

SUSE CVE-2025-61688

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.1.5 and 1.0.2, Omni might leak sensitive information via an API...

CVE-2025-57697

AstrBot Project v3.5.22 has an arbitrary file read vulnerability in function encodeimagebs64. Since the encodeimagebs64 function defined in entities.py opens the image specified by the user in the request body and returns the image content as a base64-encoded string without checking the legitimac...

CVE-2025-12909

Insufficient policy enforcement in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to leak cross-origin data via Devtools. Chromium security severity: Low...

AstrBot 安全漏洞

AstrBot is a multi-platform LLM chatbot and development framework open-sourced by AstrBot. A security vulnerability exists in AstrBot version v3.5.22, which stems from the encodeimagebs64 function not verifying the legitimacy of an image path, which could lead to arbitrary file reads and data lea...

CVE-2025-12616

PHPGurukul News Portal 1.0 contains an information disclosure flaw in an unknown function of /onps/settings.py. Manipulation can insert sensitive data into debugging code, enabling remote exploitation. The vulnerability is exploitable remotely, with high attack complexity, and public exploit avai...

PT-2025-44737

Name of the Vulnerable Software and Affected Versions Yandex Disk versions prior to 3.2.45.3275 Description A Search Order Hijacking issue exists in Yandex Disk on MacOS due to an uncontrolled search path element. This allows for exploitation of the system. Recommendations Update Yandex Disk to...

Neo4j Enterprise Edition和Neo4j Community Edition 安全漏洞

Neo4j Enterprise Edition and Neo4j Community Edition are both graph databases from Neo4j USA. A security vulnerability exists in Neo4j Enterprise Edition and Neo4j Community Edition that stems from information disclosure during the bolt protocol handshake, which could lead to an attacker obtainin...

Siemens SIMATIC Devices Out-of-bounds Read (CVE-2023-3773)

A flaw was found in the Linux kernel's IP framework for transforming packets XFRM subsystem. This issue may allow a malicious user with CAPNETADMIN privileges to cause a 4 byte out-of-bounds read of XFRMAMTIMERTHRESH when parsing netlink attributes, leading to potential leakage of sensitive heap...

CVE-2025-40035

An information disclosure flaw was found in the Linux kernel's uinput driver in the force feedback upload handling for 32-bit compatibility mode. A local user can trigger this issue by performing force feedback upload operations through the uinput device, where uninitialized padding bytes in the...

PT-2025-44178

Name of the Vulnerable Software and Affected Versions Monkey's Audio version 11.31 Description An out-of-bounds read issue exists in Monkey's Audio version 11.31, specifically within the CAPECharacterHelper::GetUTF16FromUTF8 function. This occurs due to improper handling of the length of input...