CVE-2024-32741

A vulnerability has been identified in SIMATIC CN 4100 All versions V3.0. The affected device contains hard coded password which is used for the privileged system user root and for the boot loader GRUB by default . An attacker who manages to crack the password hash gains root access to the device...

SUSE CVE-2024-56161

Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious CPU microcode resulting in loss of confidentiality and integrity of a confidential guest running under AMD SEV-SNP...

CVE-2024-24714

Unrestricted Upload of File with Dangerous Type vulnerability in bPlugins LLC Icons Font Loader.This issue affects Icons Font Loader: from n/a through 1.1.4...

CVE-2024-37149

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated technician user can upload a malicious PHP script and hijack the plugin loader to execute this malicious script. Upgrade to 10.0.16...

Important: kernel-livepatch-6.1.112-124.190

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: gpiolib: cdev: Fix use after free in lineinfochangednotify CVE-2024-36899 In the Linux kernel, the following vulnerability has been resolved: ext4: avoid OOB when system.data xattr changes underneath the filesyste...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: net/ipv6: avoid possible UAF in ip6routempathnotify CVE-2024-26852 In the Linux kernel, the following vulnerability has been resolved: ext4: avoid OOB when system.data xattr changes underneath the filesystem...

DEBIAN-CVE-2024-56161

Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious CPU microcode resulting in loss of confidentiality and integrity of a confidential guest running under AMD SEV-SNP...

Malicious code in analytics-bp-passive-tracker-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis acb2b0591e0d61f597b43b55a8fd70dfcb8aca1d696e09f2a63c4f6f5c5a1959 The OpenSSF Package Analysis project identified 'analytics-bp-passive-tracker-loader' @ 99.99.100 npm as malicious. It is considered malicious...

WordPress CM Header & Footer Script Loader plugin <= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin CM Header and Footer versions = 1.2.0...

firmware_loader: Fix possible resource leak in fw_log_firmware_info()

...

The vulnerability in the module/loaders/loader_ico.c component of the Imlib2 image processing library allows a attacker to cause a service failure.

The vulnerability in the modules/loaders/loaderico.c component of the Imlib2 image processing library is related to reading data beyond the allowable buffer size. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

Malicious code in bindbc-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3969ce36d361753fe46f849a0dba26b4548e7c90bec80c86390c47bb429ec9bf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-603 Malicious code in bindbc-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3969ce36d361753fe46f849a0dba26b4548e7c90bec80c86390c47bb429ec9bf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PYSEC-2025-58

vLLM is a library for LLM inference and serving. vllm/modelexecutor/weightutils.py implements hfmodelweightsiterator to load the model checkpoint, which is downloaded from huggingface. It uses the torch.load function and the weightsonly parameter defaults to False. When torch.load loads malicious...

Malicious code in custom-colors-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 032f8182b803592f8c4bcf04cdc223b43ac526a86a9e8a273bcc8177682b96f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PNGPlug Loader Delivers ValleyRAT Malware Through Fake Software Installers

Cybersecurity researchers are calling attention to a series of cyber attacks that have targeted Chinese-speaking regions like Hong Kong, Taiwan, and Mainland China with a known malware called ValleyRAT. The attacks leverage a multi-stage loader dubbed PNGPlug to deliver the ValleyRAT payload,...

Malicious code in vue-loader-vue3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c22e5d514334329c3b75f951d755b2a3ef9e122863f7c437530413cd6c49b986 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-257 Malicious code in vue-loader-vue3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c22e5d514334329c3b75f951d755b2a3ef9e122863f7c437530413cd6c49b986 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the UEFI loader in Howyar Reloader for Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of the UEFI loader in Howyar Reloader for Windows systems involves loading code without checking its integrity. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Termius 安全漏洞

Termius is an SSH client from Termius, Inc. A security vulnerability exists in Termius versions prior to 9.9.0 that originates from allowing a local attacker to execute arbitrary code via a specially crafted script in the DYLDINSERTLIBRARIES component...