CVE-2025-23304

NVIDIA NeMo library for all platforms contains a vulnerability in the model loading component, where an attacker could cause code injection by loading .nemo files with maliciously crafted metadata. A successful exploit of this vulnerability may lead to remote code execution and data tampering...

gdk-pixbuf-loader-libheif-1.21.1-1.1 on GA media (moderate)

gdk-pixbuf-loader-libheif-1.21.1-1.1 on GA media Announcement ID: openSUSE-SU-2026:10019-1 Rating: moderate Cross-References: CVE-2025-68431 CVSS scores: CVE-2025-68431 SUSE : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2025-68431 SUSE : 6.8...

React Router vulnerable to XSS via Open Redirects

React Router and Remix v1/v2 SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if developers are creating redirect paths...

OPENSUSE-SU-2026:10019-1 gdk-pixbuf-loader-libheif-1.21.1-1.1 on GA media

These are all security issues fixed in the gdk-pixbuf-loader-libheif-1.21.1-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2022-27938

stbimage.h aka the stb image loader 2.19, as used in libsixel and other products, has a reachable assertion in stbicreatepngimageraw...

Russia-Aligned Hackers Abuse Viber to Target Ukrainian Military and Government

The Russia-aligned threat actor known as UAC-0184 has been observed targeting Ukrainian military and government entities by leveraging the Viber messaging platform to deliver malicious ZIP archives. "This organization has continued to conduct high-intensity intelligence gathering activities again...

SUSE-RU-2026:20056-1 Recommended update for shim

This update for shim fixes the following issues: This update for shim fixes the following issues: shim is updated to version 16.1: - shimstartimage: fix guid/handle pairing when uninstalling protocols - Fix uncompressed ipv6 netboot - fix test segfaults caused by uninitialized memory -...

PT-2026-28660

Name of the Vulnerable Software and Affected Versions GIMP affected versions not specified Description A heap buffer over-read exists in the PCX file loader due to an off-by-one error. A remote attacker can trigger this by inducing a user to open a specially crafted PCX image. This may result in...

PT-2026-21332

Name of the Vulnerable Software and Affected Versions GIMP versions prior to 3.0.8-5 Description A heap-buffer-overflow exists when processing specially crafted PSD Photoshop Document files. The issue occurs within the fread pascal string function because the buffer allocated for a Pascal string ...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992708)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992708 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: zero idisksize when initializing the bootloader inode If the boot loader inode has never...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-993296)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-993296 advisory. In the Linux kernel, the following vulnerability has been resolved: powerpc/spufs: Fix refcount leak in spufsinitisolatedloader offindnodebypath returns remote devic...

SUSE-RU-2026:20004-1 Recommended update for shim

This update for shim fixes the following issues: This update for shim fixes the following issues: shim is updated to version 16.1: - shimstartimage: fix guid/handle pairing when uninstalling protocols - Fix uncompressed ipv6 netboot - fix test segfaults caused by uninitialized memory -...

Mustang Panda Uses Signed Kernel-Mode Rootkit to Load TONESHELL Backdoor

The Chinese hacking group known as Mustang Panda aka HoneyMyte has leveraged a previously undocumented kernel-mode rootkit driver to deliver a new variant of backdoor dubbed TONESHELL in a cyber attack detected in mid-2025 targeting an unspecified entity in Asia. The findings come from Kaspersky,...

PT-2025-53148

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel related to ext4 quota handling. Specifically, a bug in the es tree search function can occur due to a bad quota inode. This issue arises when the inode...

CVE-2025-68475

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2, a Regular Expression Denial of Service ReDoS vulnerability exists in Fedify's document loader. The HTML parsing regex at...

OPENSUSE-SU-2026:20000-1 Security update for salt

This update for salt fixes the following issues: Changes in salt: - Add minimumauthversion to enforce security CVE-2025-62349 - Backport security fixes for vendored tornado BDSA-2024-3438 BDSA-2024-3439 BDSA-2024-9026 - Junos module yaml loader fix CVE-2025-62348 - Require Python dependencies onl...

Malicious code in @ownbackup/ob-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 687afc025587f4d90747fd2ebf5cfe350f93f2abc39393f85d07fa96c69161e3 The package @ownbackup/ob-loader was found to contain malicious code...

EUVD-2025-204948

Malicious code in @ownbackup/ob-loader npm...

MAL-2025-192705 Malicious code in @ownbackup/ob-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 687afc025587f4d90747fd2ebf5cfe350f93f2abc39393f85d07fa96c69161e3 The package @ownbackup/ob-loader was found to contain malicious code...

CVE-2025-68475

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2, a Regular Expression Denial of Service ReDoS vulnerability exists in Fedify's document loader. The HTML parsing regex at...