Linux Distros Unpatched Vulnerability : CVE-2025-13022

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145. CVE-2025-13022 Note that Nessu...

sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems

A flaw was found in the integration of Active Directory and the System Security Services Daemon SSSD on Linux systems. In default configurations, the Kerberos local authentication plugin sssdkrb5localauthplugin is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 / 25.10 : Intel Microcode vulnerabilities (USN-7866-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 / 25.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7866-1 advisory. Barak Gross discovered that some Intel Xeon processors with SGX enabled did not properly...

Malicious code in @walletwave/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 786e84734b8e7f4af9096790c95dcb0dae82c3364c93e7a2e662c98f3e21e2c6 The package @walletwave/core was found to contain malicious code. Source: ghsa-malware df7464e8000db02c291bbd2af61bdf264c816df679997bf1cefc42d5d4825c...

MAL-2025-49384 Malicious code in tailwindcss-aerowind (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 924018214a3e9174dce76b34435456874d9e4e59b88a5d0e469af8af45d6812c The package tailwindcss-aerowind was found to contain malicious code. Source: ghsa-malware...

CVE-2025-37735

Improper preservation of permissions in Elastic Defend on Windows hosts can lead to arbitrary files on the system being deleted by the Defend service running as SYSTEM. In some cases, this could result in local privilege escalation...

sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems

A flaw was found in the integration of Active Directory and the System Security Services Daemon SSSD on Linux systems. In default configurations, the Kerberos local authentication plugin sssdkrb5localauthplugin is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an...

ThinkDashboard 安全漏洞

ThinkDashboard is a lightweight, self-hosted bookmarking dashboard by the individual developer MatiasDesu. A security vulnerability exists in ThinkDashboard version 0.6.7 and earlier, which stems from a server-side request forgery vulnerability in the /api/ping?url= endpoint that could lead an...

SUSE: Security Advisory (SUSE-SU-2025:3905-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Linux Distros Unpatched Vulnerability : CVE-2025-60753

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in libarchive bsdtar before version 3.8.1 in function applysubstitution in file tar/subst.c when processing crafted -s substitution rule...

MAL-2025-49302 Malicious code in vity-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fd2e751d57f4a04b6019488c79debf3467879ee63c322f22ebf35544584cff6 The package vity-toolkit was found to contain malicious code. Source: ghsa-malware bb4930932127303392cd175222ad1777bd0119cbea931b6bfb68c8913bbb0a40 A...

EUVD-2025-37229

A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution RCE on the Backup infrastructure hosts by an authenticated domain user...

CVE-2025-48983

A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution RCE on the Backup infrastructure hosts by an authenticated domain user...

CVE-2025-48983

A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution RCE on the Backup infrastructure hosts by an authenticated domain user...

Malicious code in snavbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5af4f54b61e8c07cb80d8f65c7ff554627597f600fe3b67094eb71097903548 At CLI startup, index.js downloads three native shared libraries sbx.so, bot.so, v1.so from https://$arch.31888.xyz/ amd64.31888.xyz, arm64.31888.xyz...

CVE-2025-47912

The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://::1/". IPv4 addresses and hostnames mus...

Malicious code in eslint-disable-next-line (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c260c70270e5f716b6e8197913327633d64aa0ee2e18ebde88c8f53f06893c62 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in uach-retrofill (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 141cbec0058112e95aa84fb85bbd30f951bf495d0ce2c8b6d2148367eb7e6ed8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48999 Malicious code in eslint-plugin-custom-eslint-rules (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 290264bf054a89de7b611685ab2f5a9720fd03d6e90c3631d42bbef29259ec48 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in twilio-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8c9791835a6b79c8a567a55e71f875ddb3c62120517d06403c6b5d68313cfa54 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...