Malicious code in candra-ketoprak58-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c2b57997616c4e5f57ef8fd736e478f134fd4270d3e6657f6842caf80ea35bb The package candra-ketoprak58-riris was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

Malicious code in cici-kupat54-wekto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4eb459b54723823225e2a1136546d59790c84d24a3119672fa5fee58b25d8d31 The package cici-kupat54-wekto was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...

MAL-2025-50180 Malicious code in dewanto-enting100-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a665fc58c92a7ac5c3b63c273561383f8235b8a8218dc161ba9e385f0a261efd The package dewanto-enting100-sukiwir was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

MAL-2025-52687 Malicious code in wati-semur63-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c229d8d2214182c68f2aff76db6656d6a896896a2741067063e04255f8c3eae8 The package wati-semur63-sluey was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...

MAL-2025-50323 Malicious code in erick-ketoprak66-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6622436ea0673ae30788dfbd52c59e875e75ceb1699f103cd651b2e19ee16e6 The package erick-ketoprak66-miaww was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

Malicious code in candra-liwet89-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eeef79a7e90f98af6c4901ea83a19951b5fcc50b0365550bdb622fd4358995a6 The package candra-liwet89-riris was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flood...

Malicious code in candra-mangut61-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3ea764bcf469f41fb052a4d94cb5374a6de3c85e3974844b504683e540e6e1c The package candra-mangut61-riris was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy

In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfsmdtdestroy In allocinode, inodeinitalways could return -ENOMEM if securityinodealloc fails, which causes inode-iprivate uninitialized. Then nilfsismetadatafileinode returns true and nilfsfreeinode...

PT-2025-46215

Name of the Vulnerable Software and Affected Versions Soft Serve versions prior to 0.11.1 Description Soft Serve, a self-hostable Git server, contains a Server-Side Request Forgery SSRF issue. The application does not validate webhook URLs, which allows repository administrators to create webhook...

Updated xen packages fix security vulnerabilities

Double unlock in x86 guest IRQ handling. CVE-2024-31143 Xapi: Metadata injection attack against backup/restore functionality. CVE-2024-31144 Error handling in x86 IOMMU identity mapping. CVE-2024-31145 PCI device pass-through with shared resources. CVE-2024-31146 x86: Deadlock in vlapicerror...

SUSE CVE-2025-41443

Mattermost versions 10.5.x = 10.5.12, 10.11.x = 10.11.2 fail to properly validate guest user permissions when accessing channel information which allows guest users to discover active public channels and their metadata via the /api/v4/teams/teamid/channels/ids endpoint...

EUVD-2025-38345

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. In versions 8.6.0 through 8.9.0, there is an authenticated, blind time-based SQL-injection inside the appMetadata-operation of the GraphQL-API. This allows extraction of arbitrary data from the...

CVE-2025-64493 SuiteCRM is Vulnerable to Authenticated Blind SQL Injection via GraphQL

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. In versions 8.6.0 through 8.9.0, there is an authenticated, blind time-based SQL-injection inside the appMetadata-operation of the GraphQL-API. This allows extraction of arbitrary data from the...

CVE-2025-64493 SuiteCRM is Vulnerable to Authenticated Blind SQL Injection via GraphQL

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. In versions 8.6.0 through 8.9.0, there is an authenticated, blind time-based SQL-injection inside the appMetadata-operation of the GraphQL-API. This allows extraction of arbitrary data from the...

CVE-2025-64493

In SuiteCRM versions 8.6.0–8.9.0, an authenticated, blind (time-based) SQL injection exists in the appMetadata operation of the GraphQL API, allowing extraction of arbitrary data without admin access. Affected component: GraphQL API, operation appMetadata. Root cause: improper handling/validation...

[SECURITY] Fedora 43 Update: luksmeta-10-1.fc43

LUKSMeta is a command line utility for storing small portions of metadata in the LUKSv1 header for use before unlocking the volume...

Fedora 43 : luksmeta (2025-e53e8fdc0a)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-e53e8fdc0a advisory. Fix handling of large metadata Fix: CVE-2025-11568 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note tha...

Faking Receipts with AI

Over the past few decades, it's become easier and easier to create fake receipts. Decades ago, it required special paper and printers--I remember a company in the UK advertising its services to people trying to cover up their affairs. Then, receipts became computerized, and faking them required...

CVE-2025-64180

Manager-io/Manager is accounting software. In Manager Desktop and Server versions 25.11.1.3085 and below, a critical vulnerability permits unauthorized access to internal network resources. The flaw lies in the fundamental design of the DNS validation mechanism. A Time-of-Check Time-of-Use TOCTOU...

The vulnerability of the jpegBase::readMetadata() function in the library and the command-line utility for managing image metadata from Exiv2 allows a attacker to cause a service failure.

The vulnerability of the jpegBase::readMetadata function in the Exiv2 library and command-line utilities for managing image metadata involves inefficient algorithmic complexity. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...