MAL-2025-3685 Malicious code in framer-motion-ext (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0d106ab331c0898de25fe772017b00559c67c1738cb04dfa7c3a93c3005bdb8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

UBUNTU-CVE-2025-23150

In the Linux kernel, the following vulnerability has been resolved: ext4: fix off-by-one error in dosplit Syzkaller detected a use-after-free issue in ext4insertdentry that was caused by out-of-bounds access due to incorrect splitting in dosplit. BUG: KASAN: use-after-free in...

PT-2025-39242

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a memory leak within the ath12k service ready ext event function. Specifically, the svc rdy ext.mac phy caps memory is not freed in failure scenarios, leading t...

Medium: ecs-service-connect-agent

Issue Overview: Envoy is a cloud-native high-performance edge/middle/service proxy. Prior to 1.33.1, 1.32.4, 1.31.6, and 1.30.10, Envoy's extproc HTTP filter is at risk of crashing if a local reply is sent to the external server due to the filter's life time issue. A known situation is the failur...

The vulnerability of the `nft_set_ext` function in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the nftsetext function in the Linux operating system’s kernel is related to insufficient verification of data authenticity. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

DEBIAN-CVE-2025-21897

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix picktaskscx picking non-queued tasks when it's called without balance a6250aa251ea "schedext: Handle cases where picktaskscx is called without preceding balancescx" added a workaround to handle the cases where...

UBUNTU-CVE-2025-21897

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix picktaskscx picking non-queued tasks when it's called without balance a6250aa251ea "schedext: Handle cases where picktaskscx is called without preceding balancescx" added a workaround to handle the cases where...

Malicious code in kagi_browser_ext (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d43b7fd2a47594e2b75e6634bd546cec8f3fb5d8c20181ce0f6ed15e368a91bb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Vulnerability of the functions get_ext_path(), ext4_find_extent(), and ext4_split_extent_at() in the Linux operating system’s kernel, allowing a hacker to cause a service failure

The vulnerability of the functions getextpath, ext4findextent, and ext4splitextentat in the Linux operating system is related to the lack of memory release after the effective lifespan of these functions has ended. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2025-30157

Envoy is a cloud-native high-performance edge/middle/service proxy. Prior to 1.33.1, 1.32.4, 1.31.6, and 1.30.10, Envoy's extproc HTTP filter is at risk of crashing if a local reply is sent to the external server due to the filter's life time issue. A known situation is the failure of a websocket...

ai.h2o:h2o-admissibleml (>=3.34.0.1 <=3.44.0.3), ai.h2o:h2o-algos (>=3.2.0.1 <=3.44.0.3) +34 more potentially affected by CVE-2024-8062 via ai.h2o:h2o-core (>=3.2.0.1 <=3.44.0.3)

ai.h2o:h2o-core MAVEN version =3.2.0.1, =3.34.0.1, =3.2.0.1, =3.2.0.1, =3.30.0.1, =3.30.0.1, =3.30.0.1, =3.30.0.1, =3.30.0.1, =3.30.1.1, =3.30.0.1, =3.30.0.1, =3.30.0.1, =3.30.0.1, =3.34.0.3, =3.30.0.1, =3.44.0.3 and more Source cves: CVE-2024-8062 Source advisory: OSV:GHSA-5C8J-G96X-CJ78...

ai.h2o:h2o-admissibleml (>=3.34.0.1 <=3.46.0.11), ai.h2o:h2o-algos (>=0.1.9 <=3.46.0.11) +49 more potentially affected by CVE-2024-6854 via ai.h2o:h2o-core (>=0.1.10 <=3.8.3.4)

ai.h2o:h2o-core MAVEN version =0.1.10, =3.34.0.1, =0.1.9, =0.1.9, =3.12.0.1, =3.8.2.4, =3.14.0.7, =3.16.0.1, =3.14.0.1, =3.24.0.1, =3.30.1.1, =3.26.0.4, =3.10.5.1, =3.24.0.1, =3.30.0.1, =3.34.0.3, =3.46.0.11 and more Source cves: CVE-2024-6854 Source advisory: SNYK:JAVA-AIH2O-9486740...

dbgpt-app (=0.8.0rc1), dbgpt-client (>=0.7.0 <=0.8.0rc1) +2 more potentially affected by CVE-2024-10829 via dbgpt (=0.8.0)

dbgpt PYPI version =0.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on dbgpt and may be impacted: - dbgpt-app =0.8.0rc1 - dbgpt-client =0.7.0, =0.7.0, =0.8.0, =0.8.0rc1 Source cves: CVE-2024-10829 Source advisory: SNYK:PYTHON-DBGPT-9586190...

dbgpt-app (=0.8.0rc1), dbgpt-client (>=0.7.0 <=0.8.0rc1) +2 more potentially affected by CVE-2024-10906 via dbgpt (=0.8.0)

dbgpt PYPI version =0.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on dbgpt and may be impacted: - dbgpt-app =0.8.0rc1 - dbgpt-client =0.7.0, =0.7.0, =0.8.0, =0.8.0rc1 Source cves: CVE-2024-10906 Source advisory: SNYK:PYTHON-DBGPT-9586747...

dbgpt-app (=0.8.0rc1), dbgpt-client (>=0.7.0 <=0.8.0rc1) +2 more potentially affected by CVE-2024-10902 via dbgpt (=0.8.0)

dbgpt PYPI version =0.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on dbgpt and may be impacted: - dbgpt-app =0.8.0rc1 - dbgpt-client =0.7.0, =0.7.0, =0.8.0, =0.8.0rc1 Source cves: CVE-2024-10902 Source advisory: SNYK:PYTHON-DBGPT-9586451...

ai.h2o:sparkling-water-api-generation_2.11 (>=3.34.0.3-1-2.2 <=3.46.0.6-1-2.4), ai.h2o:sparkling-water-api-generation_2.12 (>=3.34.0.3-1-3.0 <=3.46.0.6-1-3.5) +9 more potentially affected by CVE-2024-10572 via ai.h2o:h2o-ext-xgboost (>=3.34.0.1 <=3.46.0.6)

ai.h2o:h2o-ext-xgboost MAVEN version =3.34.0.1, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =3.34.0.1-1-2.2, =3.34.0.1-1-3.0, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =2.0.0, =2.1.2 Source cves: CVE-2024-10572 Source advisory:...

ai.h2o:h2o-admissibleml (>=3.34.0.1 <=3.46.0.11), ai.h2o:h2o-algos (>=0.1.9 <=3.46.0.11) +49 more potentially affected by CVE-2024-10549 via ai.h2o:h2o-core (>=0.1.10 <=3.8.3.4)

ai.h2o:h2o-core MAVEN version =0.1.10, =3.34.0.1, =0.1.9, =0.1.9, =3.12.0.1, =3.8.2.4, =3.14.0.7, =3.16.0.1, =3.14.0.1, =3.24.0.1, =3.30.1.1, =3.26.0.4, =3.10.5.1, =3.24.0.1, =3.30.0.1, =3.34.0.3, =3.46.0.11 and more Source cves: CVE-2024-10549 Source advisory: SNYK:JAVA-AIH2O-9486742...

Malicious code in data-ext-extra (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da42338e541d2556618253303cbf11b710a062fa58a2dc476baca9aaf8234cbd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2251 Malicious code in data-ext-extra (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da42338e541d2556618253303cbf11b710a062fa58a2dc476baca9aaf8234cbd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in amazon-codewhisperer-jupyterlab-ext (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a4e17673b58fae37b25deaea3bf55c6fdb9a69285dde321917e6e775d7cdf57 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...