ROS-20250923-01

The vulnerability in the Python programming language interpreter CPython is due to the fact that Cpython does not prohibits setting an empty list "" for SSLContext.setnpnprotocols, which is an invalid value for the OpenSSL base API when using NPN. Exploitation of the vulnerability could allow an...

Malicious Package

Overview next-plugin-uni-i18n is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malware in next-plugin-uni-i18n

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-47488 Malicious code in next-plugin-uni-i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf38f21fbce8422c8375fdbc547879dab7eea1a9773a78740cee14d4919f95ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

vxlan: Fix NPD when refreshing an FDB entry with a nexthop object

...

SUSE CVE-2023-53342

In the Linux kernel, the following vulnerability has been resolved: net: marvell: prestera: fix handling IPv4 routes with nhid Fix handling IPv4 routes referencing a nexthop via its id by replacing calls to fibinfonh with fibinfonhc. Trying to add an IPv4 route referencing a nextop via nhid: $ ip...

CVE-2022-50411

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix error code path in acpidscallcontrolmethod A use-after-free in acpipsparseaml after a failing invocaion of acpidscallcontrolmethod is reported by KASAN 1 and code inspection reveals that nextwalkstate pushed to the...

[SECURITY] Fedora 41 Update: lemonldap-ng-2.21.3-1.fc41

LemonLdap::NG is a modular Web-SSO based on Apache::Session modules. It simplifies the build of a protected area with a few changes in the application. It manages both authentication and authorization and provides headers for accounting. So you can have a full AAA protection for your web space as...

org.jenkins-ci.main:jenkins-war (1.645), org.jenkins-ci.main:test (1.645) +5 more potentially affected by CVE-2025-59476 via org.jenkins-ci.main:jenkins-core (1.645)

org.jenkins-ci.main:jenkins-core MAVEN version 1.645 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-war 1.645 - org.jenkins-ci.main:test 1.645 -...

org.jenkins-ci.main:jenkins-test-harness (1.580.2), org.jenkins-ci.main:jenkins-war (1.580.2) +3 more potentially affected by CVE-2025-59476 via org.jenkins-ci.main:jenkins-core (1.580.2)

org.jenkins-ci.main:jenkins-core MAVEN version 1.580.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.580.2 - org.jenkins-ci.main:jenkins-war 1.580.2 -...

UBUNTU-CVE-2023-53342

In the Linux kernel, the following vulnerability has been resolved: net: marvell: prestera: fix handling IPv4 routes with nhid Fix handling IPv4 routes referencing a nexthop via its id by replacing calls to fibinfonh with fibinfonhc. Trying to add an IPv4 route referencing a nextop via nhid: $ ip...

Malware in monorepo-next

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-47328 Malicious code in monorepo-next (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3f0c8e880c0edcdf1ac8b55ac831ee123c7bbd6b338a44a77a49400b60985d16 Any computer that has this package installed or running should be considered fully compromised. All...

CLSA-2025-1757947715 php: Fix of 3 CVEs

CVE-2017-9224: fix out-of-bounds read of a stack in matchat function - CVE-2017-9226: fix out-of-bounds write or read of a heap in nextstateval function - CVE-2017-9227: fix out-of-bounds read of a stack in mbcenclen function...

CVE-2022-50311

CVE-2022-50311 affects the Linux kernel: a refcount leak in cxl_calc_capp_routing due to of_get_next_parent() returning a node pointer with refcount incremented and a missing of_node_put() on the error path. The issue is resolved by adding the missing of_node_put() in the error path to balance th...

UBUNTU-CVE-2023-53192

In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix nexthop hash size The nexthop code expects a 31 bit hash, such as what is returned by fibmultipathhash and rt6multipathhash. Passing the 32 bit hash returned by skbgethash can lead to problems related to the fact that...

CVE-2023-53198 raw: Fix NULL deref in raw_get_next().

In the Linux kernel, the following vulnerability has been resolved: raw: Fix NULL deref in rawgetnext. Dae R. Jeong reported a NULL deref in rawgetnext 0. It seems that the repro was running these sequences in parallel so that one thread was iterating on a socket that was being freed in another...

CLSA-2025-1757944976 php: Fix of 3 CVEs

CVE-2017-9224: fix out-of-bounds read of a stack in matchat function - CVE-2017-9226: fix out-of-bounds write or read of a heap in nextstateval function - CVE-2017-9227: fix out-of-bounds read of a stack in mbcenclen function...

CLSA-2025-1757944902 php: Fix of 3 CVEs

CVE-2017-9224: fix out-of-bounds read of a stack in matchat function - CVE-2017-9226: fix out-of-bounds write or read of a heap in nextstateval function - CVE-2017-9227: fix out-of-bounds read of a stack in mbcenclen function...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. Compromised versions of this package contain a file called bundle.js that exfiltrates secrets from the user's accounts, including credentials and API tokens. It also downloads malicious files and repackages them...