Malicious code in winston-global-proxima-metalsmith (npm)

The package winston-global-proxima-metalsmith was found to contain malicious code...

Malicious code in global-xerxes-quark-cosmicray (npm)

The package global-xerxes-quark-cosmicray was found to contain malicious code...

MAL-2025-46871 Malicious code in zenith-kaus-global-dendrochronology (npm)

The package zenith-kaus-global-dendrochronology was found to contain malicious code...

Malicious code in optimize-css-assets-webpack-plugin-fornax-global-markdownlint (npm)

The package optimize-css-assets-webpack-plugin-fornax-global-markdownlint was found to contain malicious code...

MAL-2025-46641 Malicious code in winston-global-proxima-metalsmith (npm)

The package winston-global-proxima-metalsmith was found to contain malicious code...

CVE-2025-58459

Jenkins global-build-stats Plugin 322.v22f4db18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attackers with Overall/Read permission to enumerate graph IDs...

Linux Distros Unpatched Vulnerability : CVE-2022-30598

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise have access to it...

Security Bulletin: The IBM® Engineering Lifecycle Management products using WebSphere Application Server Liberty is affected by a security bypass in JMS messaging (CVE-2025-36124)

Summary IBM WebSphere Application Server Liberty is affected by a security bypass vulnerability in JMS messaging with the wasJmsServer-1.0, wasJmsSecurity-1.0, wasJmsClient-2.0, messagingServer-3.0, messagingSecurity-3.0, or messagingClient-3.0 feature enabled. Following IBM® Engineering Lifecycl...

Security Bulletin: The IBM® Engineering Lifecycle Management products using WebSphere Application Server Liberty is affected by a denial of service due to Apache Commons FileUpload (CVE-2025-48976)

Summary There is a vulnerability in Apache Commons FileUpload which affects IBM WebSphere Application Server traditional and affects IBM WebSphere Application Server Liberty with the servlet-3.0, servlet-3.1, servlet-4.0, servlet-5.0 or servlet-6.0 feature enabled. Following IBM® Engineering...

gfs2: No more self recovery

...

gfs2: Fix slab-use-after-free in gfs2_qd_dealloc

...

NASM v2.16 was discovered to contain a global buffer overflow in the component dbgdbg_typevalue at /output/outdbg.c.

...

CVE-2024-51423

Cross Site Scripting vulnerability in Infor Global HR GHR v.11.23.03.00.21 and before allows a remote attacker to execute arbitrary code via the class parameter...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from gfs2 unverified directory depth...

PT-2025-36073

Name of the Vulnerable Software and Affected Versions: DevicePolicyManagerService.java affected versions not specified Description: A logic error in the saveGlobalProxyLocked function within DevicePolicyManagerService.java may allow for desynchronization from persistence. This could lead to local...

An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global object's debugger vector. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.

...

Due to URL previews in the network panel of developer tools improperly storing URLs, query parameters could potentially be used to overwrite global objects in privileged code. This vulnerability affects Firefox < 110.

...

org.jenkins-ci.plugins:build-metrics (>=1.0, <=1.3) potentially affected by CVE-2025-58459 via org.jenkins-ci.plugins:global-build-stats (1.2)

org.jenkins-ci.plugins:global-build-stats MAVEN version 1.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:global-build-stats and may be impacted: - org.jenkins-ci.plugins:build-metrics =1.0, =1.3 Source cves: CVE-2025-58459...

Missing Authorization

Overview org.jenkins-ci.plugins:global-build-stats is a global-build-stats plugin Affected versions of this package are vulnerable to Missing Authorization via the REST API endpoints, which do not perform permission checks. An attacker can enumerate graph IDs by sending requests with only...

Jenkins global-build-stats Plugin missing permission check can result in graph IDs being enumerated

Jenkins global-build-stats Plugin 322.v22f4db18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attackers with Overall/Read permission to enumerate graph IDs. This has been patched in version 347.v32aeb0493c4f...