CVE-2025-60693

CVE-2025-60693 affects Linksys E1200 v2 router firmware (E1200_v2.0.11.001_us.tar.gz). The get_merge_mac function in the httpd binary concatenates up to six user-supplied CGI parameters (_0~5) into a fixed-size buffer (a2) without proper bounds checking, inserting colon delimiters during concaten...

PT-2025-46858

Name of the Vulnerable Software and Affected Versions Linksys E1200 v2 routers versions prior to 2.0.11.001 us Description A flaw exists in the get merge ipaddr function within the httpd binary. This function does not properly validate the length of data when combining user-supplied CGI parameter...

PT-2025-46905

Name of the Vulnerable Software and Affected Versions GitLab EE versions 17.8 through 18.3.6 GitLab EE versions 18.4 through 18.4.4 GitLab EE versions 18.5 through 18.5.2 Description An authenticated attacker could potentially leak sensitive information from confidential issues. This is possible ...

kernel: afs: Fix merge preference rule failure condition

In the Linux kernel, the following vulnerability has been resolved: afs: Fix merge preference rule failure condition syzbot reported a lock held when returning to userspace1. This is because if argc is less than 0 and the function returns directly, the held inode lock is not released. Fix this by...

Prototype Pollution

Overview expr-eval is a Mathematical expression evaluator Affected versions of this package are vulnerable to Prototype Pollution via unrestricted member access IMEMBER and user-defined functions IFUNDEF in the expression evaluator. An attacker can execute arbitrary JavaScript code by providing...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989739)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989739 advisory. In the Linux kernel, the following vulnerability has been resolved: bfq: Update cgroup information before merging bio When the process is migrated to a different...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989256)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989256 advisory. In the Linux kernel, the following vulnerability has been resolved: bfq: Avoid merging queues with different parents It can happen that the parent of a bfqq changes...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988987)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988987 advisory. In the Linux kernel, the following vulnerability has been resolved: dma-buf/syncfile: Don't leak fences on merge failure Each addfence call does a dmafenceget on the...

CVE-2025-12642

lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be exploited to conduct HTTP Header Smuggling attacks. Successful exploitation may allow an attacker to: Bypass access control rules Inject unsafe input into backend logic that trusts reque...

CVE-2025-12642 HTTP Header Smuggling via Trailer Merge

lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be exploited to conduct HTTP Header Smuggling attacks. Successful exploitation may allow an attacker to: Bypass access control rules Inject unsafe input into backend logic that trusts reque...

CVE-2025-12642

Lighttpd 1.4.80 is affected by an HTTP header smuggling vulnerability caused by incorrectly merging trailer fields into headers during request parsing. This can enable bypassing access controls and injecting unsafe input into backend logic that relies on headers, with potential for HTTP Request S...

Prototype Pollution

Overview mongo-object is an An API for interacting with a MongoDB document or modifier Affected versions of this package are vulnerable to Prototype Pollution via the expandKey function in util.js. An attacker can modify the JavaScript prototype chain by supplying a crafted property path containi...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: mapletree: Fixed the MASTATEPREALLOC flag in maspreallocate. The preallocation flag is temporarily cleared when explicit requests for allocations are made. Existing allocations are already counted against the request through...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: f2fs: Fixed the issue where uninitialized values were used in the extentinfo structure during the isextentmergeable and isbackmergeable functions, through the read extent tree path. The root cause of the issue is that the...

Command Injection

Overview cli-onprem is a CLI tool for infrastructure engineers Affected versions of this package are vulnerable to Command Injection due to the use of shell-invoked subprocess calls with unvalidated input. An attacker can execute arbitrary commands by injecting shell metacharacters in the directo...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to various issues in postgresql

Summary IBM Watson Speech Services Cartridge is vulnerable to various issues in postgresql please see below. Postgresql is used in our speech utilities. This vulnerabilitiy has been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2023-39417 DESCRIPTION: I...

Malicious code in account-merge-site (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9da6b4c4378cd7eac26edb573618fc697b4312cfef6741c25ceb45871856fad The package account-merge-site was found to contain malicious code...

EUVD-2025-37186

Malicious code in account-merge-site npm...

MAL-2025-49107 Malicious code in account-merge-site (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9da6b4c4378cd7eac26edb573618fc697b4312cfef6741c25ceb45871856fad The package account-merge-site was found to contain malicious code...

Malicious Package

Overview transform-merge-sibling-variables is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...