FreeBSD -- SO_REUSEPORT_LB breaks connect(2) for UDP sockets

Problem Description: Connected sockets are not intended to belong to load-balancing groups. However, the kernel failed to check the connection state of sockets when adding them to load-balancing groups. Furthermore, when looking up the destination socket for an incoming packet, the kernel will...

FreeBSD-SA-25:09.netinet

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-25:09.netinet Security Advisory The FreeBSD Project Topic: SOREUSEPORTLB breaks connect2 for UDP sockets Category: core Module: netinet Announced: 2025-10-22...

CVE-2025-62528

Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for a project member to put JavaScript in name or description fields which would run on project load. This issue has been patched in version 1.5.0...

EUVD-2025-35143

Malicious code in webpack-css-load-branch npm...

Malicious code in webpack-css-load-branch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ebc3a0cfad4acfa46f4ea9e57edb732f20403908d855eca202b5ad08df232468 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview webpack-css-load-branch is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

MAL-2025-48538 Malicious code in webpack-css-load-branch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ebc3a0cfad4acfa46f4ea9e57edb732f20403908d855eca202b5ad08df232468 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987602)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987602 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction AV/C deferred transactio...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987685)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987685 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: Do not unset preset when cleaning up codec Several functions that take part in codec's...

PYSEC-2025-188

Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for a project member to put JavaScript in name or description fields which would run on project load. This issue has been patched in version 1.5.0...

CVE-2025-62528

Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for a project member to put JavaScript in name or description fields which would run on project load. This issue has been patched in version 1.5.0...

EUVD-2025-35096

Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for a project member to put JavaScript in name or description fields which would run on project load. This issue has been patched in version 1.5.0...

EUVD-2025-35066

In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: audioreach: fix potential null pointer dereference It is possible that the topology parsing function audioreachwidgetloadmodulecommon could return NULL or an error pointer. Add missing NULL check so that we do not...

microcode_ctl security update

2:2.1-73.24.0.20250512 - update microcode bundle to 20250512 Orabug: 38139038 2:2.1-73.23.0.20250211 - update microcode bundle to 20250211 Orabug: 37670820 - drop releasenote.md file 2:2.1-73.20.0.1 - don't bother calling dracut if virtualized Orabug: 35702409 - also rebuild initramfs for...

ABB ALS-mini-s4 IP和ABB ALS-mini-s8 IP 访问控制错误漏洞

The ABB ALS-mini-s4 IP and ABB ALS-mini-s8 IP are both intelligent load management controllers from ABB Switzerland. An access control error vulnerability exists in the ABB ALS-mini-s4 IP and ABB ALS-mini-s8 IP that stems from a lack of authentication for critical functions...

JLSEC-2025-109 FFmpeg through 4.3 has a heap-based buffer overflow in `avio_get_str` in `libavformat/aviobuf.c`...

FFmpeg through 4.3 has a heap-based buffer overflow in aviogetstr in libavformat/aviobuf.c because dnnbackendnative.c calls ffdnnloadmodelnative and a certain index check is omitted...

JLSEC-2025-148 A flaw was found in FFmpeg

A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation...

PT-2025-45940

A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation...

SUSE CVE-2025-60358

radare2 v.5.9.8 and before contains a memory leak in the function loadrelocations...

CVE-2025-62168

Squid (proxy/cache) prior to version 7.2 is affected by information disclosure due to failure to redact HTTP authentication credentials in error handling. The vulnerability can allow a remote, unauthenticated attacker to learn credentials or tokens used by a trusted client or internal web applica...