CVE-2025-40348

CVE-2025-40348 concerns a race in the Linux kernel slab allocator. When two threads concurrently execute alloc_slab_obj_exts() and one fails to allocate the object extension vector, the winning thread may overwrite the other thread’s valid slab->obj_exts with OBJEXTS_ALLOC_FAIL, leading the ra...

CVE-2025-40348 slab: Avoid race on slab->obj_exts in alloc_slab_obj_exts

In the Linux kernel, the following vulnerability has been resolved: slab: Avoid race on slab-objexts in allocslabobjexts If two competing threads enter allocslabobjexts and one of them fails to allocate the object extension vector, it might override the valid slab-objexts allocated by the other...

CVE-2025-40348 slab: Avoid race on slab->obj_exts in alloc_slab_obj_exts

In the Linux kernel, the following vulnerability has been resolved: slab: Avoid race on slab-objexts in allocslabobjexts If two competing threads enter allocslabobjexts and one of them fails to allocate the object extension vector, it might override the valid slab-objexts allocated by the other...

PT-2025-51564

In the Linux kernel, the following vulnerability has been resolved: slab: Avoid race on slab-obj exts in alloc slab obj exts If two competing threads enter alloc slab obj exts and one of them fails to allocate the object extension vector, it might override the valid slab-obj exts allocated by the...

PT-2025-51713

In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via project configuration...

ROS-20251216-7371

A vulnerability in the Extensions component of Google Chrome and Microsoft Edge browsers is related to incorrect resource initialization. Exploitation of the vulnerability may allow a remote attacker to gain unauthorized access to protected information...

ROS-20251216-7363

A vulnerability in the Extensions component of Google Chrome and Microsoft Edge browsers is related to access control flaws. Exploitation of the vulnerability could allow a remote attacker to gain unauthorized access to protected information...

ROS-20251216-7358

A vulnerability in the Extensions component of Google Chrome and Microsoft Edge browsers is related to flaws in the implementation of security checks for standard elements. Exploitation of the vulnerability could allow an attacker acting remotely to bypass existing security restrictions...

Linux Distros Unpatched Vulnerability : CVE-2025-68199

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - codetag: debug: handle existing CODETAGEMPTY in markobjextsempty for slabobjext When allocslabobjexts fails and then later succeeds in allocating a slab...

PyMdown Extensions 安全漏洞

PyMdown Extensions is a collection of extensions for Python Markdown by the individual developer Isaac Muse. A security vulnerability exists in PyMdown Extensions versions prior to 10.16.1, which stems from a ReDOS vulnerability in the configure caption extension, which could lead to prolonged...

PT-2025-51612

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.18.0-rc1+ Description The Linux kernel contains a flaw related to the handling of CODETAG EMPTY in the mark objexts empty function for slab object extensions. Specifically, when a slab extension vector allocati...

CVE-2025-68142

creationtimestamp| type| source ---|---|--- 2025-12-15 22:07:58+00:00| published-proof-of-concept| https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-r6h4-mm7h-8pmq...

GO-2025-4211 Babylon Nil BlockHash in BLS vote extensions triggers panics in consensus handlers in github.com/babylonlabs-io/babylon

Babylon Nil BlockHash in BLS vote extensions triggers panics in consensus handlers in github.com/babylonlabs-io/babylon...

A Browser Extension Risk Guide After the ShadyPanda Campaign

In early December 2025, security researchers exposed a cybercrime campaign that had quietly hijacked popular Chrome and Edge browser extensions on a massive scale. A threat group dubbed ShadyPanda spent seven years playing the long game, publishing or acquiring harmless extensions, letting them r...

Directory Traversal

Dosage is vulnerable to Directory Traversal. The vulnerability is due to improper handling of file extensions derived from the HTTP Content-Type header, which allows an attacker to write arbitrary files outside the intended directory...

OPENSUSE-SU-2025:20150-1 Security update for binutils

This update for binutils fixes the following issues: Changes in binutils: - Update to current 2.45 branch at 94cb1c075 to include fix for PR33584 a problem related to LTO vs fortran COMMON blocks. - Do not enable '-z gcs=implicit' on aarch64 for old codestreams. Update to version 2.45: New...

CVE-2025-14265

In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of...

CVE-2024-58280

CMSimple 5.15 contains a remote command execution vulnerability that allows authenticated attackers to modify file extensions and upload malicious PHP files. Attackers can append ',php' to Extensionsuserfiles and upload a shell script to the media directory to execute arbitrary code on the server...

Malicious Visual Studio Code Extensions Hide Trojan in Fake PNG Files

VS Code developers beware: ReversingLabs found 19 malicious extensions hiding trojans inside a popular dependency, disguising the final malware payload as a standard PNG image file...

CVE-2025-14265

In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of...