PT-2025-47052

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 17.6 through 18.3.6 GitLab CE/EE versions 18.4 through 18.4.4 GitLab CE/EE versions 18.5 through 18.5.2 Description A flaw exists in GitLab CE/EE that, in certain situations, could allow unauthorized users to view...

kernel: afs: Fix merge preference rule failure condition

In the Linux kernel, the following vulnerability has been resolved: afs: Fix merge preference rule failure condition syzbot reported a lock held when returning to userspace1. This is because if argc is less than 0 and the function returns directly, the held inode lock is not released. Fix this by...

Prototype Pollution

Overview expr-eval is a Mathematical expression evaluator Affected versions of this package are vulnerable to Prototype Pollution via unrestricted member access IMEMBER and user-defined functions IFUNDEF in the expression evaluator. An attacker can execute arbitrary JavaScript code by providing...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989739)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989739 advisory. In the Linux kernel, the following vulnerability has been resolved: bfq: Update cgroup information before merging bio When the process is migrated to a different...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989256)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989256 advisory. In the Linux kernel, the following vulnerability has been resolved: bfq: Avoid merging queues with different parents It can happen that the parent of a bfqq changes...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988987)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988987 advisory. In the Linux kernel, the following vulnerability has been resolved: dma-buf/syncfile: Don't leak fences on merge failure Each addfence call does a dmafenceget on the...

CVE-2025-12642

lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be exploited to conduct HTTP Header Smuggling attacks. Successful exploitation may allow an attacker to: Bypass access control rules Inject unsafe input into backend logic that trusts reque...

CVE-2025-12642

Lighttpd 1.4.80 is affected by an HTTP header smuggling vulnerability caused by incorrectly merging trailer fields into headers during request parsing. This can enable bypassing access controls and injecting unsafe input into backend logic that relies on headers, with potential for HTTP Request S...

CVE-2025-12642 HTTP Header Smuggling via Trailer Merge

lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be exploited to conduct HTTP Header Smuggling attacks. Successful exploitation may allow an attacker to: Bypass access control rules Inject unsafe input into backend logic that trusts reque...

Prototype Pollution

Overview mongo-object is an An API for interacting with a MongoDB document or modifier Affected versions of this package are vulnerable to Prototype Pollution via the expandKey function in util.js. An attacker can modify the JavaScript prototype chain by supplying a crafted property path containi...

Command Injection

Overview cli-onprem is a CLI tool for infrastructure engineers Affected versions of this package are vulnerable to Command Injection due to the use of shell-invoked subprocess calls with unvalidated input. An attacker can execute arbitrary commands by injecting shell metacharacters in the directo...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to various issues in postgresql

Summary IBM Watson Speech Services Cartridge is vulnerable to various issues in postgresql please see below. Postgresql is used in our speech utilities. This vulnerabilitiy has been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2023-39417 DESCRIPTION: I...

EUVD-2025-37186

Malicious code in account-merge-site npm...

Malicious code in account-merge-site (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9da6b4c4378cd7eac26edb573618fc697b4312cfef6741c25ceb45871856fad The package account-merge-site was found to contain malicious code...

MAL-2025-49107 Malicious code in account-merge-site (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9da6b4c4378cd7eac26edb573618fc697b4312cfef6741c25ceb45871856fad The package account-merge-site was found to contain malicious code...

Malicious code in transform-merge-sibling-variables (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8d380989059db5a476085e3c65f461f844bd193d30a4f2558f711086525e20ae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview transform-merge-sibling-variables is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

MAL-2025-49048 Malicious code in transform-merge-sibling-variables (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8d380989059db5a476085e3c65f461f844bd193d30a4f2558f711086525e20ae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

UBUNTU-CVE-2025-40054

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix UAF issue in f2fsmergepagebio As JY reported in bugzilla 1, Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 pc : 0xffffffe51d249484 f2fsiscpguaranteed+0x70/0x98 lr : 0xffffffe51d24ad...

CVE-2025-40054

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix UAF issue in f2fsmergepagebio As JY reported in bugzilla 1, Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 pc : 0xffffffe51d249484 f2fsiscpguaranteed+0x70/0x98 lr : 0xffffffe51d24ad...