MAL-2025-47360 Malicious code in verror-extra (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3a93fdd891eeff42ebf7abff1e7a6a00febbc8420ef4bef6c613ef250f4f3ca3 Any computer that has this package installed or running should be considered fully compromised. All...

CVE-2025-43333

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to gain root privileges...

CVE-2025-43317

A permissions issue in multiple Apple products, including iOS , iPadOS , macOS Tahoe , tvOS , visionOS , and watchOS , was addressed with additional restrictions. The root cause involves improper access control (CWE-284), which could allow an application to access sensitive user data . The vulner...

CVE-2023-53213

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: slab-out-of-bounds read in brcmfgetassocies Fix a slab-out-of-bounds read that occurs in kmemdup called from brcmfgetassocies. The bug could occur when associnfo-reqlen, data from a URB provided by a USB device, i...

CVE-2023-53213 wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies()

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: slab-out-of-bounds read in brcmfgetassocies Fix a slab-out-of-bounds read that occurs in kmemdup called from brcmfgetassocies. The bug could occur when associnfo-reqlen, data from a URB provided by a USB device, i...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. Compromised versions of this package contain a file called bundle.js that exfiltrates secrets from the user's accounts, including credentials and API tokens. It also downloads malicious files and repackages them...

PT-2025-37833

Name of the Vulnerable Software and Affected Versions: macOS versions prior to Sequoia 15.7 macOS versions prior to Sonoma 14.8 macOS versions prior to Tahoe 26 Description: A file quarantine bypass existed due to missing checks, potentially allowing an application to escape its sandbox...

kernel: ext4: use-after-free in ext4_xattr_set_entry()

A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inode size for extended attributes. This flaw allows a privileged local user to cause a system crash or other undefined behaviors...

Malicious code in nohack-erlinglingba-extra-part1 (npm)

The package nohack-erlinglingba-extra-part1 was found to contain malicious code...

Malicious code in nohack-erlinglingba-extra-part2 (npm)

The package nohack-erlinglingba-extra-part2 was found to contain malicious code...

MAL-2025-45340 Malicious code in nohack-erlinglingba-extra-part2 (npm)

The package nohack-erlinglingba-extra-part2 was found to contain malicious code...

MAL-2025-45339 Malicious code in nohack-erlinglingba-extra-part1 (npm)

The package nohack-erlinglingba-extra-part1 was found to contain malicious code...

PT-2025-36331

Name of the Vulnerable Software and Affected Versions MongoDB Server versions prior to 6.0.25 MongoDB Server versions prior to 7.0.22 MongoDB Server versions prior to 8.0.12 MongoDB Server versions prior to 8.1.2 Description An authorized user can cause a crash in the MongoDB Server through a...

mongodb -- Malformed $group Query May Cause MongoDB Server to Crash

[email protected] reports: An authorized user can cause a crash in the MongoDB Server through a specially crafted $group query. This vulnerability is related to the incorrect handling of certain accumulator functions when additional parameters are specified within the $group operation. This...

CVE-2025-22430

In isInSignificantPlace of multiple files, there is a possible way to access sensitive information due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-49722

In showAvatarPicker of EditUserPhotoController.java, there is a possible cross user image leak due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48529

In setRingtoneUri of VoicemailNotificationSettingsUtil.java , there is a possible cross user data leak due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48530

In multiple locations, there is a possible condition that results in OOB accesses due to an incorrect bounds check. This could lead to remote code execution in combination with other bugs, with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-32331

In showDismissibleKeyguard of KeyguardService.java, there is a possible way to bypass app pinning due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-32332

The Google Android operating system is affected by a memory corruption vulnerability caused by a use after free condition in multiple locations. This flaw allows an attacker to achieve local escalation of privilege without requiring additional execution privileges or user interaction. While sever...