SUSE-SU-2026:0196-1 Security update for ovmf

This update for ovmf fixes the following issues: - CVE-2023-45231: Fixed out of bounds read when handling a ND Redirect message with truncated options bsc1218881. - CVE-2023-45232: Fixed infinite loop when parsing unknown options in the Destination Options header bsc1218882. - CVE-2023-45233: Fix...

PT-2026-27658

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel’s VXLAN implementation. When the system boots with IPv6 disabled 'ipv6.disable=1', the necessary network table nd tbl is not initialized, leading to a...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-992661)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992661 advisory. In the Linux kernel, the following vulnerability has been resolved: acpi: nfit: fix narrowing conversion in acpinfitctl Syzkaller has reported a warning in...

EUVD-2015-6220

Malware in sbrugna...

EUVD-2015-6221

Malware in sbrugna...

EUVD-2019-6695

Malware in sbrugna...

EUVD-2019-6736

Malware in sbrugna...

EUVD-2019-6698

Malware in sbrugna...

EUVD-2019-6697

Malware in sbrugna...

EUVD-2019-6699

Malware in sbrugna...

EUVD-2022-6856

Malicious code in bioql PyPI...

EUVD-2022-51953

Malicious code in bioql PyPI...

TP-Link warns of botnet infecting routers and targeting Microsoft 365 accounts

TP-Link has issued a warning about a botnet exploiting two vulnerabilities to infect small office/home SOHO routers, which are then weaponized to attack Microsoft 365 accounts. The vulnerabilities affect the Archer C7 and TL-WR841N/ND routers, though other models may also be at risk. Despite the...

CVE-2025-9377

CVE-2025-9377 is an OS command injection (authenticated RCE) vulnerability on TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9 in the Parental Control page, affecting versions before 241108. The issues are tied to end-of-life devices; TP-Link released patches and recommended upgrading where possi...

VulnCheck KEV: CVE-2025-9377

The authenticated remote command execution RCE vulnerability exists in the Parental Control page on TP-Link Archer C7EU V2 and TL-WR841N/NDMS V9. This issue affects Archer C7EU V2: before 241108 and TL-WR841N/NDMS V9: before 241108. Both products have reached the status of EOL end-of-life. It's...

DEBIAN-CVE-2025-38072

In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Fix divide error in ndlabeldatainit If a faulty CXL memory device returns a broken zero LSA size in its memory device information Identify Memory Device Opcode 4000h, CXL spec. 3.1, 8.2.9.9.1.1, a divide error...

CVE-2024-5220

The ND Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's upload feature in all versions up to, and including, 7.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access an...

CVE-2022-41229

Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.134 and earlier does not escape configuration options of the Execute NetStorm/NetCloud Test build step, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

CVE-2022-4623

The ND Shortcodes WordPress plugin before 7.0 does not validate and escape numerous of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2022-41227

A cross-site request forgery CSRF vulnerability in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers to connect to an attacker-specified webserver using attacker-specified credentials...