MAL-2025-47492 Malicious code in react-device-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 113702b97f378bfde6af287d00821b1e3ebec6cfa164e3d263f57632210869c8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

nightmare

This repository is an introduction to binary exploitation and reverse engineering course based on CTF challenges, called "Nightmare". It contains a large amount of content, with over 90 challenges, laid out in a linear fashion, and well-documented write-ups explaining how to go from being handed...

Unbreakable Enterprise kernel security update

5.15.0-312.187.5.3 - HID: core: do not bypass hidhwrawrequest Benjamin Tissoires Orabug: 38454666 CVE-2025-38494 - vsock: Do not allow binding to VMADDRPORTANY Budimir Markovic Orabug: 38454665 CVE-2025-38618 - cloneprivatemnt: make sure that caller has CAPSYSADMIN in the right userns Al Viro...

Hyper-V Data Management Component Command Execution

The vulnerability of the data management component in virtual machine environments within Hyper-V software for centralized backup and recovery management systems like PowerProtect Data Manager is related to the failure to address specific elements that could mitigate this vulnerability. Exploitin...

CVE-2025-47906 vulnerabilities

Vulnerabilities for packages: mongodb-kubernetes-operator, grafana-operator, container-object-storage-interface, kube-vip-cloud-provider, kuberay-operator, pvc-autoresizer, shfmt, newrelic-nri-statsd, terraform-provider-time, vault-benchmark, sftpgo-plugin-geoipfilter, dagdotdev, checksec,...

GHSA-GWRF-JF3H-W649 vulnerabilities

Vulnerabilities for packages: mongodb-kubernetes-operator, grafana-operator, container-object-storage-interface, kube-vip-cloud-provider, kuberay-operator, pvc-autoresizer, shfmt, newrelic-nri-statsd, terraform-provider-time, vault-benchmark, sftpgo-plugin-geoipfilter, dagdotdev, checksec,...

CVE-2025-47906 vulnerabilities

Vulnerabilities for packages: terraform-provider-time, bank-vaults, rancher-machine, nvidia-nsight-compute-13.2, karpenter, karma-fips, lvm-driver, custom-pod-autoscaler-operator, kubeflow-katib, azurefile-csi-fips, local-path-provisioner, modelmesh-runtime-adapter,...

GHSA-GWRF-JF3H-W649 vulnerabilities

Vulnerabilities for packages: terraform-provider-time, bank-vaults, rancher-machine, nvidia-nsight-compute-13.2, karpenter, karma-fips, lvm-driver, custom-pod-autoscaler-operator, kubeflow-katib, azurefile-csi-fips, local-path-provisioner, modelmesh-runtime-adapter,...

KVM: x86: use array_index_nospec with indices that come from guest

...

Inference Attacks on Encrypted Online Voting Via Traffic Analysis

Online voting enables individuals to participate in elections remotely, offering greater efficiency and accessibility in both governmental and organizational settings. As this method gains popularity, ensuring the security of online voting systems becomes increasingly vital, as the systems...

UBUNTU-CVE-2023-53438

In the Linux kernel, the following vulnerability has been resolved: x86/MCE: Always save CS register on AMD Zen IF Poison errors The Instruction Fetch IF units on current AMD Zen-based systems do not guarantee a synchronous MC is delivered for poison consumption errors. Therefore,...

CVE-2023-53438

CVE-2023-53438 : In the Linux kernel, the AMD Zen IF poison error path could misclassify context due to non-synchronous delivery of poison by the IF unit. The issue is mitigated by adding a quirk to always save the Code Segment (CS) register when poison is consumed from the IF unit banks, ensurin...

UBUNTU-CVE-2023-53395

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Add AMLNOOPERANDRESOLVE flag to Timer ACPICA commit 90310989a0790032f5a0140741ff09b545af4bc5 According to the ACPI specification 19.6.134, no argument is required to be passed for ASL Timer instruction. For taking care of...

PT-2025-38457

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the x86/MCE subsystem related to handling Machine Check Exceptions MCE on AMD Zen-based systems. Specifically, the Instruction Fetch IF units may...

Malicious code in ng-imports-checker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 18b18b9fde01428e5307224f34cca2ee013b4d455573e0da91abc9d6ee0c1438 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-53319

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle kvmarminit failure correctly in finalizepkvm Currently there is no synchronisation between finalizepkvm and kvmarminit initcalls. The finalizepkvm proceeds happily even if kvmarminit fails resulting in the...

CVE-2023-53319 KVM: arm64: Handle kvm_arm_init failure correctly in finalize_pkvm

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle kvmarminit failure correctly in finalizepkvm Currently there is no synchronisation between finalizepkvm and kvmarminit initcalls. The finalizepkvm proceeds happily even if kvmarminit fails resulting in the...

AZL-67419 CVE-2025-39823 affecting package kernel for versions less than 6.6.104.2-1

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: use arrayindexnospec with indices that come from guest min and destid are guest-controlled indices. Using arrayindexnospec after the bounds checks clamps these values to mitigate speculative execution side-channels...

CVE-2025-39811 drm/xe/vm: Clear the scratch_pt pointer on error

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: Clear the scratchpt pointer on error Avoid triggering a dereference of an error pointer on cleanup in xevmfreescratch by clearing any scratchpt error pointer. cherry picked from commit...

CVE-2023-53273

In the Linux kernel vulnerability CVE-2023-53273, the issue lies in the vmbus driver’s channel handling. The function relid2channel() assumes the vmbus channel array is allocated, but in multi-kernel scenarios (e.g., kdump/kexec), not all relids are reset by the host. If a guest receives a vmbus ...