AZL-65066 CVE-2025-23166 affecting package nodejs18 for versions less than 18.20.3-8

The C++ method SignTraits::DeriveBits may incorrectly call ThrowException based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary...

PT-2025-24353

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved. The issue is related to the generation of procfs content for a bcm op that is in the process of being removed, which might show...

Russia-Linked APT28 Exploited MDaemon Zero-Day to Hack Government Webmail Servers

A Russia-linked threat actor has been attributed to a cyber espionage operation targeting webmail servers such as Roundcube, Horde, MDaemon, and Zimbra via cross-site scripting XSS vulnerabilities, including a then-zero-day in MDaemon, according to new findings from ESET. The activity, which...

narayana: deadlock via multiple join requests sent to LRA Coordinator

A security issue was discovered in the LRA Coordinator component of Narayana. When Cancel is called in LRA, an execution time of approximately 2 seconds occurs. If Join is called with the same LRA ID within that timeframe, the application may crash or hang indefinitely, leading to a denial of...

IBM Semeru Runtime 安全漏洞

IBM Semeru Runtime is an open source Java runtime environment provided by IBM , based on the Eclipse Adoptium project , support for a variety of operating systems and architectures , to provide high-performance and high-reliability running platform for Java applications . A denial of service...

CVE-2025-44186: Cross-Site Request Forgery (CSRF)

SourceCodester Best Employee Management System 1.0 is vulnerable to Cross Site Request Forgery CSRF in /admin/Operation/User.php page...

CVE-2025-40556

A vulnerability has been identified in BACnet ATEC 550-440 All versions, BACnet ATEC 550-441 All versions, BACnet ATEC 550-445 All versions, BACnet ATEC 550-446 All versions. Affected devices improperly handle specific incoming BACnet MSTP messages. This could allow an attacker residing in the sa...

kernel: ext4: fix i_data_sem unlock order in ext4_ind_migrate()

A flaw was found in the kernel's ext4 filesystem. When an EXT4IOCMIGRATE ioctl input/output control operation, requiring synchronous updates, races with a write2 system call, it can lead to a deadlock. This deadlock occurs specifically when the CONFIGPROVELOCKING option is enabled, potentially...

kernel: afs: Fix the setting of the server responding flag

A flaw was found in the Linux kernel's AFS Andrew File System module. This vulnerability occurs in the afswaitforoperation function, where the op-server pointer is not properly validated for NULL before being used. A local attacker with low privileges could exploit this flaw, leading to a system...

kernel: virtio_pmem: add the missing REQ_OP_WRITE for flush bio

A flaw was discovered in the virtiopmem driver in the Linux kernel, where flush block I/O requests did not have the required REQOPWRITE operation code assigned before submission. Under workloads involving persistent memory block devices — for example, running mkfs.xfs on a pmem device,this omissi...

⚡ Weekly Recap: Zero-Day Exploits, Developer Malware, IoT Botnets, and AI-Powered Scams

What do a source code editor, a smart billboard, and a web server have in common? They've all become launchpads for attacks—because cybercriminals are rethinking what counts as "infrastructure." Instead of chasing high-value targets directly, threat actors are now quietly taking over the...

ASUS Armoury Crate 安全漏洞

ASUS Armoury Crate is a utility software developed by ASUS to centrally control and manage ROG Gamerland and some ASUS gaming products. ASUS Armoury Crate suffers from a stack buffer overflow vulnerability that originates from a boundary error when the application handles untrusted input, which c...

SUSE CVE-2025-37840

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: brcmnand: fix PM resume warning Fixed warning on PM resume as shown below caused due to uninitialized struct nandoperation that checks chip select field : WARNONop-cs = nanddevntargets&chip-base 14.588522 ----------...

SUSE CVE-2025-37846

In the Linux kernel, the following vulnerability has been resolved: arm64: mops: Do not dereference src reg for a set operation The source register is not used for SET and reading it can result in a UBSAN out-of-bounds array access error, specifically when the MOPS exception is taken from a SET...

SUSE CVE-2025-37877

In the Linux kernel, the following vulnerability has been resolved: iommu: Clear iommu-dma ops on cleanup If iommudeviceregister encounters an error, it can end up tearing down already-configured groups and default domains, however this currently still leaves devices hooked up to iommu-dma and ev...

BREAKING: 7,000-Device Proxy Botnet Using IoT, EoL Systems Dismantled in U.S. - Dutch Operation

A joint law enforcement operation undertaken by Dutch and U.S. authorities has dismantled a criminal proxy network that's powered by thousands of infected Internet of Things IoT and end-of-life EoL devices, enlisting them into a botnet for providing anonymity to malicious actors. In conjunction...

CVE-2025-37846

In the Linux kernel, the following vulnerability has been resolved: arm64: mops: Do not dereference src reg for a set operation The source register is not used for SET and reading it can result in a UBSAN out-of-bounds array access error, specifically when the MOPS exception is taken from a SET...

DEBIAN-CVE-2025-37840

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: brcmnand: fix PM resume warning Fixed warning on PM resume as shown below caused due to uninitialized struct nandoperation that checks chip select field : WARNONop-cs = nanddevntargets&chip-base 14.588522 ----------...

UBUNTU-CVE-2025-37840

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: brcmnand: fix PM resume warning Fixed warning on PM resume as shown below caused due to uninitialized struct nandoperation that checks chip select field : WARNONop-cs = nanddevntargets&chip-base 14.588522 ----------...

CVE-2025-37877 iommu: Clear iommu-dma ops on cleanup

In the Linux kernel, the following vulnerability has been resolved: iommu: Clear iommu-dma ops on cleanup If iommudeviceregister encounters an error, it can end up tearing down already-configured groups and default domains, however this currently still leaves devices hooked up to iommu-dma and ev...