Insertion of Sensitive Information Into Sent Data

Overview @sentry/bun is an Official Sentry SDK for bun Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the sendDefaultPii configuration option. An attacker can gain access to sensitive HTTP headers, such as authentication cookies, by viewi...

Insertion of Sensitive Information Into Sent Data

Overview @sentry/core is a Base implementation for all Sentry JavaScript SDKs Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the sendDefaultPii configuration option. An attacker can gain access to sensitive HTTP headers, such as...

CVE-2025-52666

Improper neutralisation of format characters in the settings of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an administrator user to disable the admin user console due to a fatal PHP error...

Fake calendar invites are spreading. Here’s how to remove them and prevent more

We’re seeing a surge in phishing calendar invites that users can’t delete, or that keep coming back because they sync across devices. The good news is you can remove them and block future spam by changing a few settings. Most of these unwanted calendar entries are there for phishing purposes. Mos...

CVE-2025-52666

Improper neutralisation of format characters in the settings of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an administrator user to disable the admin user console due to a fatal PHP error...

Siemens SCALANCE and RUGGEDCOM Devices Improper Input Validation (CVE-2024-50296)

hns3: A kernel crash may occur when the driver is uninstalled and the VF is disabled concurrently. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description...

squid security update

7:3.5.20-17.0.9.13 - Fixes CVE-2025-62168, squid: Squid vulnerable to information disclosure via - authentication credential leakage in error handling Orabug: 38587551 7:3.5.20-17.0.7.13 - Fixes CVE-2025-54574, add URN access disabling config options Orabug: 38350105 7:3.5.20-17.0.5.13 - Fixed cv...

PT-2025-47086

Name of the Vulnerable Software and Affected Versions WeiYe-Jing datax-web versions up to 2.1.2 Description A flaw exists in the Job Handler component of WeiYe-Jing datax-web, specifically within the remove, update, pause, start, and triggerJob functions. This issue results in improper access...

The vulnerability of the optc32_disable_crtc() function in the drivers/gpu/drm/amd/display/dc/dcn32/dcn32_optc.c driver module allows a hacker to trigger a service failure in AMD graphics cards that support Direct Rendering Infrastructure (DRI) in Linux operating systems.

The vulnerability of the optc32disablecrtc function in the drivers/gpu/drm/amd/display/dc/dcn32/dcn32optc.c driver module related to AMD graphics cards for Linux operating systems is associated with a numerical overflow. Exploiting this vulnerability could allow an attacker to cause a service...

The vulnerability of the btrfs_quota_disable() function in the fs/btrfs/qgroup.c module of the file system support module for Linux kernel allows a malicious actor to cause a service failure.

The vulnerability of the btrfsquotadisable function in the fs/btrfs/qgroup.c module of the btrfs file system support module in Linux systems is related to incorrect resource locking. Exploiting this vulnerability could allow an attacker to cause a service failure...

EUVD-2025-175312

PrivateBin's template-switching feature allows arbitrary local file inclusion through path traversal...

EUVD-2025-175314

js-yaml has prototype pollution in merge...

SUSE CVE-2025-40142

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Disable bottom softirqs as part of spinlockirq on PREEMPTRT sndpcmgrouplockirq acquires a spinlockt and disables interrupts via spinlockirq. This also implicitly disables the handling of softirqs such as TIMERSOFTIRQ. ...

Relative Path Traversal

Overview privatebin/privatebin is a minimalist, open source online pastebin where the server has zero knowledge of pasted data. Affected versions of this package are vulnerable to Relative Path Traversal via the template-switching feature when templateselection is enabled in the configuration. An...

CVE-2025-64718

CVE-2025-64718 affects js-yaml, allowing prototype pollution via proto when parsing untrusted YAML. The issue is patched in js-yaml 4.1.1 and in 3.14.2. Public IBM bulletins confirm usage of vulnerable js-yaml versions in IBM Maximo components and recommend upgrading to a fixed release (e.g., js-...

Malicious code in index-gamma-authorize-deploy-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 855a93e5306676df25469d50536f602165b1a8e5b59b3116fe63ffd6dba16314 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187540 Malicious code in iota-less-loader-commitlint-config-angular-private (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc9a2cc8ab09085bacdd14c9dfdd31ec3738bd42d232c1c5a7b3a72c15ab2016 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Linux Distros Unpatched Vulnerability : CVE-2025-64345

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime is a runtime for WebAssembly. Prior to version 38.0.4, 37.0.3, 36.0.3, and 24.0.5, Wasmtime's Rust embedder API contains an unsound interaction where a...

Siemens SIMATIC S7-1500 Improper Input Validation (CVE-2024-2004)

When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been...

Siemens SIMATIC S7-1500 Improper Input Validation (CVE-2025-21767)

In the Linux kernel, the following vulnerability has been resolved: clocksource: Use migratedisable to avoid calling getrandomu32 in atomic context The following bug report happened with a PREEMPTRT kernel: BUG: sleeping function called from invalid context at kernel/locking/spinlockrt.c:48...