CVE-2024-56232

Cross-Site Request Forgery CSRF vulnerability in Alex Volkov WP Nice Loader wp-nice-loader allows Stored XSS.This issue affects WP Nice Loader: from n/a through = 0.1.0.4...

CVE-2024-32741

A vulnerability has been identified in SIMATIC CN 4100 All versions V3.0. The affected device contains hard coded password which is used for the privileged system user root and for the boot loader GRUB by default . An attacker who manages to crack the password hash gains root access to the device...

SUSE CVE-2024-56161

Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious CPU microcode resulting in loss of confidentiality and integrity of a confidential guest running under AMD SEV-SNP...

CVE-2024-24714

Unrestricted Upload of File with Dangerous Type vulnerability in bPlugins LLC Icons Font Loader.This issue affects Icons Font Loader: from n/a through 1.1.4...

CVE-2024-37149

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated technician user can upload a malicious PHP script and hijack the plugin loader to execute this malicious script. Upgrade to 10.0.16...

Important: kernel-livepatch-6.1.112-124.190

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: gpiolib: cdev: Fix use after free in lineinfochangednotify CVE-2024-36899 In the Linux kernel, the following vulnerability has been resolved: ext4: avoid OOB when system.data xattr changes underneath the filesyste...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: net/ipv6: avoid possible UAF in ip6routempathnotify CVE-2024-26852 In the Linux kernel, the following vulnerability has been resolved: ext4: avoid OOB when system.data xattr changes underneath the filesystem...

DEBIAN-CVE-2024-56161

Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious CPU microcode resulting in loss of confidentiality and integrity of a confidential guest running under AMD SEV-SNP...

Malicious code in analytics-bp-passive-tracker-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis acb2b0591e0d61f597b43b55a8fd70dfcb8aca1d696e09f2a63c4f6f5c5a1959 The OpenSSF Package Analysis project identified 'analytics-bp-passive-tracker-loader' @ 99.99.100 npm as malicious. It is considered malicious...

WordPress CM Header & Footer Script Loader plugin <= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin CM Header and Footer versions = 1.2.0...

CVE-2024-56161: Improper Verification of Cryptographic Signature

Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious CPU microcode resulting in loss of confidentiality and integrity of a confidential guest running under AMD SEV-SNP...

firmware_loader: Fix possible resource leak in fw_log_firmware_info()

...

Imlib2 Image Processing Library Heap Buffer Overflow DoS

The vulnerability in the modules/loaders/loaderico.c component of the Imlib2 image processing library is related to reading data beyond the allowable buffer size. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

Malicious code in bindbc-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3969ce36d361753fe46f849a0dba26b4548e7c90bec80c86390c47bb429ec9bf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-603 Malicious code in bindbc-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3969ce36d361753fe46f849a0dba26b4548e7c90bec80c86390c47bb429ec9bf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

mpv:fuzzer_loadfile_mkv: Crash in put_pixels8_xy2_8_c

Project: https://github.com/mpv-player/mpv.git Detailed Report: https://oss-fuzz.com/testcase?key=4553009115234304 Project: mpv Fuzzing Engine: libFuzzer Fuzz Target: fuzzerloadfilemkv Job Type: libfuzzermsanmpv Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7a5834bca00f Crash State...

PYSEC-2025-58

vLLM is a library for LLM inference and serving. vllm/modelexecutor/weightutils.py implements hfmodelweightsiterator to load the model checkpoint, which is downloaded from huggingface. It uses the torch.load function and the weightsonly parameter defaults to False. When torch.load loads malicious...

Malicious code in custom-colors-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 032f8182b803592f8c4bcf04cdc223b43ac526a86a9e8a273bcc8177682b96f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PNGPlug Loader Delivers ValleyRAT Malware Through Fake Software Installers

Cybersecurity researchers are calling attention to a series of cyber attacks that have targeted Chinese-speaking regions like Hong Kong, Taiwan, and Mainland China with a known malware called ValleyRAT. The attacks leverage a multi-stage loader dubbed PNGPlug to deliver the ValleyRAT payload,...

Malicious code in vue-loader-vue3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c22e5d514334329c3b75f951d755b2a3ef9e122863f7c437530413cd6c49b986 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...