Malicious code in webpack-next (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc49a758bac1d2b78a4c0e8880c22a12d4ee54f21af0e98829c17652f1ecaadb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-260 Malicious code in webpack-next (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc49a758bac1d2b78a4c0e8880c22a12d4ee54f21af0e98829c17652f1ecaadb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-142 Malicious code in next-refresh-token (npm)

This package executes a post-install script to collect system data and sends it to a remote server. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c1d44ee35f1e7a2f1a815de12ce539b2c3ffcb9ef5dc72eb632de64e000cf1b7 Any computer that has this package installed or runni...

Security Bulletin: IBM Engineering Requirements Management DOORS Next uses a CKEditor version affected by multiple vulnerabilities

Summary IBM Engineering Requirements Management DOORS Next uses a CKEditor version vulnerable to CVE-2021-33829 'Cross-site Scripting', CVE-2020-27193 'Cross-site Scripting', CVE-2021-26272 ReDoS, CVE-2021-41164 'Cross-site Scripting', CVE-2021-26271 ReDoS, CVE-2021-37695 'Cross-site Scripting',...

SUSE CVE-2024-57892

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix slab-use-after-free due to dangling pointer dqipriv When mounting ocfs2 and then remounting it as read-only, a slab-use-after-free occurs after the user uses a syscall to quotagetnextquota. Specifically, sbdqinfosb,...

DEBIAN-CVE-2024-57890

In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Prevent integer overflow issue In the expression "cmd.wqesize cmd.wrcount", both variables are u32 values that come from the user so the multiplication can lead to integer wrapping. Then we pass the result to...

DEBIAN-CVE-2024-57892

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix slab-use-after-free due to dangling pointer dqipriv When mounting ocfs2 and then remounting it as read-only, a slab-use-after-free occurs after the user uses a syscall to quotagetnextquota. Specifically, sbdqinfosb,...

Malicious code in example-app-next (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2be5a6457ed09a44d55d954a5176fe895a1cd866bf1ca6f3b6e20a105121f0ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-23027

CVE-2025-23027 affects the next-forge Next.js boilerplate. The root cause is a BASEHUB_TOKEN committed in apps/web/.env.example, exposing credentials and potentially granting unauthorized access if the token is active. Public references (NVD/Red Hat/OSV and others) describe the issue in terms of ...

CVE-2025-23027

next-forge is a Next.js project boilerplate for modern web application. The BASEHUBTOKEN commited in apps/web/.env.example. Users should avoid use of this token and should remove any access it may have in their systems...

CVE-2025-23027 BASEHUB_TOKEN commited in next-forge

next-forge is a Next.js project boilerplate for modern web application. The BASEHUBTOKEN commited in apps/web/.env.example. Users should avoid use of this token and should remove any access it may have in their systems...

CVE-2025-23027 BASEHUB_TOKEN commited in next-forge

next-forge is a Next.js project boilerplate for modern web application. The BASEHUBTOKEN commited in apps/web/.env.example. Users should avoid use of this token and should remove any access it may have in their systems...

next-forge 安全漏洞

next-forge is a production-grade Turborepo template for the Next.js application by Hayden Bleasel, an individual developer. A security vulnerability exists in versions prior to next-forge 3.0.11 that stems from the submission of BASEHUBTOKEN in the apps/web/.env.example file, which could lead to...

CVE-2025-23027: Cleartext Storage of Sensitive Information

next-forge is a Next.js project boilerplate for modern web application. The BASEHUBTOKEN commited in apps/web/.env.example. Users should avoid use of this token and should remove any access it may have in their systems...

Linux kernel BPF LPM Trie Heap Buffer Overflow DoS

The vulnerability of the triegetnextkey function in the kernel/bpf/lpmtrie.c module of the Linux operating system is related to memory allocation beyond the allocated buffer. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of t...

SUSE CVE-2024-49573

In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix NEXTBUDDY Adam reports that enabling NEXTBUDDY insta triggers a WARN in picknextentity. Moving clearbuddies up before the delayed dequeue bits ensures no -next buddy becomes delayed. Further ensure no new -next...

DEBIAN-CVE-2024-49573

In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix NEXTBUDDY Adam reports that enabling NEXTBUDDY insta triggers a WARN in picknextentity. Moving clearbuddies up before the delayed dequeue bits ensures no -next buddy becomes delayed. Further ensure no new -next...

UBUNTU-CVE-2024-49573

In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix NEXTBUDDY Adam reports that enabling NEXTBUDDY insta triggers a WARN in picknextentity. Moving clearbuddies up before the delayed dequeue bits ensures no -next buddy becomes delayed. Further ensure no new -next...

CVE-2024-49573

CVE-2024-49573 relates to the Linux kernel scheduler (sched/fair.c). The fix patches NEXT_BUDDY handling in pick_next_entity() by moving clear_buddies() before the delayed dequeue logic and ensuring no new next buddy starts as delayed. This addresses a WARN triggered by enabling NEXT_BUDDY, with ...

CVE-2024-49573 sched/fair: Fix NEXT_BUDDY

In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix NEXTBUDDY Adam reports that enabling NEXTBUDDY insta triggers a WARN in picknextentity. Moving clearbuddies up before the delayed dequeue bits ensures no -next buddy becomes delayed. Further ensure no new -next...