CVE-2025-56648

npm parcel 2.0.0-alpha and before has an Origin Validation Error vulnerability. Malicious websites can send XMLHTTPRequests to the application's development server and read the response to steal source code when developers visit them. Mitigation Mitigation for this issue is either not available o...

CVE-2025-59427: Exposure of Sensitive Information to an Unauthorized Actor

The Cloudflare Vite plugin enables a full-featured integration between Vite and the Workers runtime. When utilising the Cloudflare Vite plugin in its default configuration, all files are exposed by the local dev server, including files in the root directory that contain secret information such as...

The vulnerability of the packet_dev_mc() function in the net/packet/af_packet.c module of Linux kernel allows a hacker to cause a service failure.

The vulnerability of the packetdevmc function in the net/packet/afpacket.c module of Linux operating systems is related to the state of the race condition. Exploiting this vulnerability can allow a hacker to cause a service failure...

DEBIAN-CVE-2023-53376

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Use number of bits to manage bitmap sizes To allocate bitmaps, the mpi3mr driver calculates sizes of bitmaps using byte as unit. However, bitmap helper functions assume that bitmaps are allocated using unsigned long...

CVE-2023-53376 scsi: mpi3mr: Use number of bits to manage bitmap sizes

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Use number of bits to manage bitmap sizes To allocate bitmaps, the mpi3mr driver calculates sizes of bitmaps using byte as unit. However, bitmap helper functions assume that bitmaps are allocated using unsigned long...

CVE-2022-50392

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8183: fix refcount leak in mt8183mt6358ts3a227max98357devprobe The node returned by ofparsephandle with refcount incremented, ofnodeput needs be called when finish using it. So add it in the error path in...

PT-2025-38455

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak may occur in the SCSI subsystem's SNIC driver if the device add function fails. Specifically, if device add returns an error, the memory allocated for the device name by de...

SUSE CVE-2023-53343

In the Linux kernel, the following vulnerability has been resolved: icmp6: Fix null-ptr-deref of ip6nullentry-rt6iidev in icmp6dev. With some IPv6 Ext Hdr RPL, SRv6, etc., we can send a packet that has the link-local address as src and dst IP and will be forwarded to an external IP in the IPv6 Ex...

@58860ed6ffd9e897/gold-finger-extension (1.0.2), @ableaura/ableui (0.1.0) +1050 more potentially affected by CVE-2025-56648 via @parcel/reporter-dev-server (>=2.0.0-beta.1, <=2.16.3)

@parcel/reporter-dev-server NPM version =2.0.0-beta.1, =7.0.0, =7.0.0, =1.0.0-beta.2, =5.0.0, =0.0.1, =5.1.0, =2.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.2 and more Source cves: CVE-2025-56648 Source advisory: OSV:GHSA-QM9P-F9J5-W83W...

Malicious code in lynx-dev (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-47435 Malicious code in lynx-dev (npm)

The package communicates with a domain associated with malicious activity...

Origin Validation Error

Overview @parcel/reporter-dev-server is a Blazing fast, zero configuration web application bundler Affected versions of this package are vulnerable to Origin Validation Error via improper origin validation in the development server. An attacker can access source code by tricking a developer into...

@58860ed6ffd9e897/gold-finger-extension (1.0.2), @ableaura/ableui (0.1.0) +1501 more potentially affected by CVE-2025-56648 via @parcel/reporter-dev-server (>=2.0.0-beta.1, <=2.16.4)

@parcel/reporter-dev-server NPM version =2.0.0-beta.1, =5.1.9, =7.0.0, =8.3.0-pre.2022-06-22.sha-42703caf, =7.0.0, =0.1.0, =1.0.0-beta.2, =5.0.0, =0.0.9, =0.0.1, =5.1.0, =5.2.5 and more Source cves: CVE-2025-56648 Source advisory: SNYK:JS-PARCELREPORTERDEVSERVER-12878606...

CVE-2023-53343 icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev().

In the Linux kernel, the following vulnerability has been resolved: icmp6: Fix null-ptr-deref of ip6nullentry-rt6iidev in icmp6dev. With some IPv6 Ext Hdr RPL, SRv6, etc., we can send a packet that has the link-local address as src and dst IP and will be forwarded to an external IP in the IPv6 Ex...

Directory Traversal

vite-plugin-static-copy is vulnerable to Directory Traversal. The vulnerability is due to improper access control because apps exposing the Vite dev server to the network --host or server.host config option allow attackers to retrieve arbitrary files by which an attacker can access arbitrary file...

Linux Distros Unpatched Vulnerability : CVE-2022-50278

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PNP: fix name memory leak in pnpallocdev After commit 1fa5ae857bb1 driver core: get rid of struct device's busid string array, the name of device is allocated...

SUSE CVE-2023-53325

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: dp: Change logging to dev for mtkdpauxtransfer Change logging from drmerr,info to deverr,info in functions mtkdpauxtransfer and mtkdpauxdotransfer: this will be essential to avoid getting NULL pointer kernel panics ...

Malware in mstate-dev-react

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @tnf-dev/core

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @tnf-dev/js

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...