Linux Distros Unpatched Vulnerability : CVE-2018-10999

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Exiv2 0.26. The Exiv2::Internal::PngChunk::parseTXTChunk function has a heap- based buffer over-read. CVE-2018-10999 Note that Nessus...

Linux Distros Unpatched Vulnerability : CVE-2016-7180

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - epan/dissectors/packet-ipmi-trace.c in the IPMI trace dissector in Wireshark 2.x before 2.0.6 does not properly consider whether a string is constant, which...

Linux Distros Unpatched Vulnerability : CVE-2016-3452

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and...

Linux Distros Unpatched Vulnerability : CVE-2013-2384

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 an...

Linux Distros Unpatched Vulnerability : CVE-2017-13003

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The LMP parser in tcpdump before 4.9.2 has a buffer over-read in print-lmp.c:lmpprint. CVE-2017-13003 Note that Nessus relies on the presence of the package as...

Linux Distros Unpatched Vulnerability : CVE-2017-1000126

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - exiv2 0.26 contains a Stack out of bounds read in webp parser CVE-2017-1000126 Note that Nessus relies on the presence of the package as reported by the vendor...

Linux Distros Unpatched Vulnerability : CVE-2017-12449

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The bfdvmssavesizedstring function in vms-misc.c in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.29 and earlier, allows...

Linux Distros Unpatched Vulnerability : CVE-2021-20201

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in spice in versions before 0.14.92. A DoS tool might make it easier for remote attackers to cause a denial of service CPU consumption by...

GO-2025-3460 Distribution's token authentication allows attacker to inject an untrusted signing key in a JWT in github.com/distribution/distribution

Distribution's token authentication allows attacker to inject an untrusted signing key in a JWT in github.com/distribution/distribution...

Linux Distros Unpatched Vulnerability : CVE-2010-3773

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11, when the XMLHttpRequestSpy module in the Firebug add-on is used, does not...

Linux Distros Unpatched Vulnerability : CVE-2007-6067

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Algorithmic complexity vulnerability in the regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 befor...

PYSEC-2025-7 Posts scraped data to IP address associated with other malware distribution attacks.

Published in 2021, the imblog package is a Python library that scrapes data from a blog page to an IP address associated with other malware distribution attacks...

Posts scraped data to IP address associated with other malware distribution attacks.

Published in 2021, the imblog package is a Python librarythat scrapes data from a blog page to an IP address associated with other malware distribution attacks...

PT-2025-8758 · Pypi · Imblog

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue concerns a Python library that scrapes data from a blog page to an IP address associated with other malware distribution attacks. Recommendations: At the moment, there is no...

Hackers Exploit Fake GitHub Repositories to Spread GitVenom Malware

Kaspersky's Securelist exposes the GitVenom campaign involving fake GitHub repositories to distribute malware. Targeting developers with seemingly legitimate…...

GHSA-7WRW-R4P8-38RX vulnerabilities

Vulnerabilities for packages: sftpgo-plugin-eventstore, aws-signer-notation-plugin, kubernetes-event-exporter, render-template, k8s-device-plugin, extism, litestream, lazydocker, nri-discovery-kubernetes, kube-vip, pombump, argo-events, crossplane-provider-keycloak, velero-plugin-for-csi, frp,...

CVE-2025-27144 vulnerabilities

Vulnerabilities for packages: falcoctl, kyverno-notation-aws, tekton-chains, trufflehog, k3s, traefik, timestamp-authority, step-ca, terragrunt, dex, argocd-image-updater, buildah, kubescape, podman, bank-vaults, gomplate, frp, apko, kube-rbac-proxy, undock, dagger,...

GHSA-C6GW-W398-HV78 vulnerabilities

Vulnerabilities for packages: falcoctl, kyverno-notation-aws, tekton-chains, trufflehog, k3s, traefik, timestamp-authority, step-ca, terragrunt, dex, argocd-image-updater, buildah, kubescape, podman, bank-vaults, gomplate, frp, apko, kube-rbac-proxy, undock, dagger,...

CVE-2025-27143 Beter Auth has an Open Redirect via Scheme-Less Callback Parameter

Better Auth is an authentication and authorization library for TypeScript. Prior to version 1.1.21, the application is vulnerable to an open redirect due to improper validation of the callbackURL parameter in the email verification endpoint and any other endpoint that accepts callback url. While...

A week in security (February 17 – February 23)

Last week on Malwarebytes Labs: Healthcare security lapses keep piling up SecTopRAT bundled in Chrome installer distributed via Google Ads Google Docs used by infostealer ACRStealer as part of attack DeepSeek found to be sharing user data with TikTok parent company ByteDance Malwarebytes introduc...