MAL-2025-41859 Malicious code in @espace-client-axafr/global-popin (npm)

The package communicates with a domain associated with malicious activity...

Phishing Campaign Uses UpCrypter in Fake Voicemail Emails to Deliver RAT Payloads

Cybersecurity researchers have flagged a new phishing campaign that's using fake voicemails and purchase orders to deliver a malware loader called UpCrypter. The campaign leverages "carefully crafted emails to deliver malicious URLs linked to convincing phishing pages," Fortinet FortiGuard Labs...

Arista EOS security vulnerabilities

Arista EOS is a fully programmable, highly modular, Linux-based network operating system from Arista Corporation. A security vulnerability exists in Arista EOS that stems from the possibility that the global common encryption key configuration may be recorded in plaintext, potentially leading to...

Linux Distros Unpatched Vulnerability : CVE-2017-17531

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote...

Malicious code in global-copilot-menu (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-41387 Malicious code in global-copilot-menu (npm)

The package communicates with a domain associated with malicious activity...

ffmpeg:ffmpeg_AV_CODEC_ID_SANM_fuzzer: Global-buffer-overflow in old_codec37

Project: https://git.ffmpeg.org/ffmpeg.git https://github.com/FFmpeg/FFmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=4900348960768000 Project: ffmpeg Fuzzing Engine: afl Fuzz Target: ffmpegAVCODECIDSANMfuzzer Job Type: aflasanffmpeg Platform Id: linux Crash Type:...

UBUNTU-CVE-2025-38659

In the Linux kernel, the following vulnerability has been resolved: gfs2: No more self recovery When a node withdraws and it turns out that it is the only node that has the filesystem mounted, gfs2 currently tries to replay the local journal to bring the filesystem back into a consistent state. N...

CVE-2025-38659 gfs2: No more self recovery

In the Linux kernel, the following vulnerability has been resolved: gfs2: No more self recovery When a node withdraws and it turns out that it is the only node that has the filesystem mounted, gfs2 currently tries to replay the local journal to bring the filesystem back into a consistent state. N...

CVE-2025-38659

The CVE-2025-38659 issue affects the Linux kernel GFS2 self-recovery path. When a node withdraws and is the only node mounting the filesystem, gfs2_recover_func() would be sidestepped, and prior code could dereference sdp->sd_jdesc->jd_inode, a use-after-free/NULL dereference situation sinc...

CVE-2025-38659 gfs2: No more self recovery

In the Linux kernel, the following vulnerability has been resolved: gfs2: No more self recovery When a node withdraws and it turns out that it is the only node that has the filesystem mounted, gfs2 currently tries to replay the local journal to bring the filesystem back into a consistent state. N...

CVE-2025-47650

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Infility Infility Global infility-global allows Path Traversal.This issue affects Infility Global: from n/a through = 2.15.11...

CVE-2025-51991

XWiki through version 17.3.0 is vulnerable to Server-Side Template Injection SSTI in the Administration interface, specifically within the HTTP Meta Info field of the Global Preferences Presentation section. An authenticated administrator can inject crafted Apache Velocity template code, which is...

CVE-2025-51990

XWiki through version 17.3.0 is affected by multiple stored Cross-Site Scripting XSS vulnerabilities in the Administration interface, specifically under the Presentation section of the Global Preferences panel. An authenticated administrator can inject arbitrary JavaScript payloads into the HTTP...

CVE-2025-55631

Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.46622503122283 was discovered to manage users' sessions system wide instead of an account-by-account basis, potentially leading to a Denial of Service DoS via resource exhaustion. NOTE: the Supplier reports that the...

mpv:fuzzer_loadfile: Global-buffer-overflow in exif_parse_ifd_list

Project: https://github.com/mpv-player/mpv.git Detailed Report: https://oss-fuzz.com/testcase?key=4777363075563520 Project: mpv Fuzzing Engine: libFuzzer Fuzz Target: fuzzerloadfile Job Type: libfuzzerasanmpv Platform Id: linux Crash Type: Global-buffer-overflow READ 8 Crash Address: 0x5a4ba8fcba...

Improper Neutralization of Special Elements Used in a Template Engine

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via improper handling of dynamic template rendering in the HTTP Meta Info field of the Global Preferences Presentation section. An attacker can execute arbitrary...

CVE-2025-51991

XWiki through version 17.3.0 is vulnerable to Server-Side Template Injection SSTI in the Administration interface, specifically within the HTTP Meta Info field of the Global Preferences Presentation section. An authenticated administrator can inject crafted Apache Velocity template code, which is...

CVE-2025-51990

XWiki through version 17.3.0 is affected by multiple stored Cross-Site Scripting XSS vulnerabilities in the Administration interface, specifically under the Presentation section of the Global Preferences panel. An authenticated administrator can inject arbitrary JavaScript payloads into the HTTP...

CVE-2025-47650

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Infility Infility Global infility-global allows Path Traversal.This issue affects Infility Global: from n/a through = 2.15.06...