USN-7853-3: Linux kernel (Azure) vulnerabilities

Jean-Claude Graf, Sandro Rüegge, Ali Hajiabadi, and Kaveh Razavi discovered that the Linux kernel contained insufficient branch predictor isolation between a guest and a userspace hypervisor for certain processors. This flaw is known as VMSCAPE. An attacker in a guest VM could possibly use this t...

Malicious code in dandh8112 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06f2bb5fabeb29dfa7cd1921c6c28f491ec017dddaae26b427f956b1f5f3c288 The package dandh8112 was found to contain malicious code. Source: ghsa-malware 439693dc034f10b79277c48f7d3457adc09a623d5d067afa83543f5393f8825e Any...

Lexmark Printers Server-Side Request Forgery (CVE-2025-9269)

A Server-Side Request Forgery SSRF vulnerability has been identified in the embedded web server in various Lexmark devices. This vulnerability can be leveraged by an attacker to force the device to send an arbitrary HTTP request to a third-party server. CVSSv4 Base Score 6.9...

Lexmark Printers Access of Resource Using Incompatible Type (CVE-2023-26063)

A type confusion vulnerability has been identified in PostScript interpreter in various Lexmark devices. The vulnerability can be leveraged by an attacker to execute arbitrary code. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid503899; scriptversion"1.3";...

Lexmark Printers Improper Input Validation (CVE-2023-26067)

A trusted internal component of Lexmark devices has an input validation vulnerability. This vulnerability can be leveraged by an attacker who has already compromised the device to escalate privileges. NOTE: This vulnerability cannot be used to compromise a device, it can only be used on a device...

Lexmark Printers Return of Pointer Value Outside of Expected Range (CVE-2024-11345)

A heap-based memory vulnerability has been identified in the Postscript interpreter in various Lexmark devices. The vulnerability can be leveraged by an attacker to execute arbitrary code as an unprivileged user. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description...

CVE-2025-59392

On Elspec G5 devices through 1.2.2.19, a person with physical access to the device can reset the Admin password by inserting a USB drive containing a publicly documented reset string into a USB port...

Cisco Warns of New Firewall Attack Exploiting CVE-2025-20333 and CVE-2025-20362

Cisco on Wednesday disclosed that it became aware of a new attack variant that's designed to target devices running Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software releases that are susceptible to CVE-2025-20333 and...

Rigged Poker Games

The Department of Justice has indicted thirty-one people over the high-tech rigging of high-stakes poker games. In a typical legitimate poker game, a dealer uses a shuffling machine to shuffle the cards randomly before dealing them to all the players in a particular order. As set forth in the...

USN-7863-1: Linux kernel vulnerabilities

Jean-Claude Graf, Sandro Rüegge, Ali Hajiabadi, and Kaveh Razavi discovered that the Linux kernel contained insufficient branch predictor isolation between a guest and a userspace hypervisor for certain processors. This flaw is known as VMSCAPE. An attacker in a guest VM could possibly use this t...

USN-7863-1 linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities

Jean-Claude Graf, Sandro Rüegge, Ali Hajiabadi, and Kaveh Razavi discovered that the Linux kernel contained insufficient branch predictor isolation between a guest and a userspace hypervisor for certain processors. This flaw is known as VMSCAPE. An attacker in a guest VM could possibly use this t...

Cloudflare Scrubs Aisuru Botnet from Top Domains List

For the past week, domains associated with the massive Aisuru botnet have repeatedly usurped Amazon , Apple , Google and Microsoft in Cloudflare's public ranking of the most frequently requested websites. Cloudflare responded by redacting Aisuru domain names from their top websites list. The chie...

MQTT 安全漏洞

MQTT Message Queuing Telemetry Transport is an ISO standard ISO/IEC PRF 20922 publishing/subscribing paradigm-based messaging protocol that operates on the TCP/IP family of protocols and is designed for use in situations where hardware performance is low on remote devices and network conditions a...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990612)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990612 advisory. In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix underflow in second superblock position calculations Macro NILFSSB2OFFSETBYTES, which...

PT-2025-45256

Name of the Vulnerable Software and Affected Versions Elspec G5 versions through 1.2.2.19 Description A person with physical access to the device can reset the Admin password by inserting a USB drive containing a publicly documented reset string into a USB port. Recommendations Versions prior to...

linux-firmware security update

20251030-999.44.1.gite9292517.el7 - Include AMD ucode fix Orabug: 38523856 CVE-2025-62626...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990597)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990597 advisory. In the Linux kernel, the following vulnerability has been resolved: net: USB: Fix wrong-direction WARNING in plusb.c The syzbot fuzzer detected a bug in the plusb...

CVE-2025-43418

This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1. An attacker with physical access to a locked device may be able to view sensitive user information...

CVE-2025-54325

An issue was discovered in VTS in Samsung Mobile Processor and Wearable Processor Exynos 1080, 1280, 2200, 1380, 1480, 2400, 1580, 2500, W920, W930, W1000. A race condition in the VTS driver results in an out-of-bounds read, leading to an information leak...

CVE-2025-43345

A correctness issue was addressed with improved checks. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. An app may be able to access sensitive user data...