Important Photon OS Security Update - PHSA-2025-4.0-0913

Updates of 'linux' packages of Photon OS have been released...

Linux Distros Unpatched Vulnerability : CVE-2025-43432

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1,...

Linux Distros Unpatched Vulnerability : CVE-2025-43443

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - This issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvO...

Linux Distros Unpatched Vulnerability : CVE-2025-43429

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A buffer overflow was addressed with improved bounds checking. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS...

Linux Distros Unpatched Vulnerability : CVE-2025-43419

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The issue was addressed with improved memory handling. This issue is fixed in Safari 26, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26...

RHSA-2025:21328 Red Hat Security Advisory: OpenShift Container Platform 4.14.59 packages and security update

Bulletin has no description...

BIT-GITLAB-2025-6171 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.2 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated attacker with reporter access to view branch names and pipeline details by accessing the packages API endpoint even wh...

GHSA-R4VM-3MC7-PRGX vulnerabilities

Vulnerabilities for packages: linux-azure, linux-gcp, linux-aws...

Ubuntu: Security Advisory (USN-7874-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

@kimuson/claude-code-viewer (>=0.4.2-beta.2, <=0.5.9), @netlify/agent-runner-cli (>=1.31.0-alpha, <=1.49.5-alpha) +10 more potentially affected by CVE-2025-64755 via @anthropic-ai/claude-code (>=2.0.0, <=2.0.27)

@anthropic-ai/claude-code NPM version =2.0.0, =0.4.2-beta.2, =1.31.0-alpha, =0.5.2, =0.0.0, =0.1.2, =0.11.1, =0.11.0, =1.0.0, =0.10.2, =0.11.2, =0.13.21 Source cves: CVE-2025-64755 Source advisory: OSV:GHSA-7MV8-J34Q-VP7Q...

@arianrhodsandlot/release-kit (>=0.1.0, <=0.1.6), @blueprintui/cli (>=0.7.2, <=0.11.3) +50 more potentially affected by CVE-2025-13437 via zx (>=8.0.0, <=8.8.4-lite)

zx NPM version =8.0.0, =0.1.0, =0.7.2, =0.9.0, =0.0.22, =1.2.3, =2.0.0-alpha.45, =0.1.0, =2.0.2-96651090, =1.1.0-beta-0acd9fac-20250513, =0.1.0, =0.3.1, =0.0.2, =0.0.1, =0.0.2, =0.0.6 and more Source cves: CVE-2025-13437 Source advisory: OSV:GHSA-W87R-VG9Q-CRQM...

@avalabs/avalanche-module (>=0.0.0-CP-8940-20240801175729, <=4.0.1), @avalabs/bitcoin-module (>=0.0.0-CP-8940-20240801175729, <=4.0.1) +20 more potentially affected by CVE-2025-64767 via @hpke/core (>=1.2.5, <=1.7.4)

@hpke/core NPM version =1.2.5, =0.0.0-CP-8940-20240801175729, =0.0.0-CP-8940-20240801175729, =2.8.0-canary.a436aaa.0, =2.8.0-alpha.197, =2.8.0-alpha.197, =2.8.0-alpha.197, =2.8.0-alpha.197, =2.8.0-canary.a436aaa.0, =2.8.0-alpha.197, =2.8.0-alpha.197, =2.8.0-alpha.197, =2.8.0-canary.a436aaa.0,...

CVE-2025-64185 Open OnDemand RPM packages create world writable locations

Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, Open OnDemand packages create world writable locations in the GEMPATH. Open OnDemand versions 4.0.8 and 3.1.16 have been patched for this vulnerability...

Blockchain and Node.js abused by Tsundere: an emerging botnet

Introduction Tsundere is a new botnet, discovered by our Kaspersky GReAT around mid-2025. We have correlated this threat with previous reports from October 2024 that reveal code similarities, as well as the use of the same C2 retrieval method and wallet. In that instance, the threat actor created...

Malicious Package

Overview com.unity.polyspatial.xr is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Important Photon OS Security Update - PHSA-2025-5.0-0687

Updates of 'openssh', 'frr' packages of Photon OS have been released...

AlmaLinux 8 : idm:DL1 (ALSA-2025:21140)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:21140 advisory. python-kdcproxy: Unauthenticated SSRF via Realm?Controlled DNS SRV CVE-2025-59088 python-kdcproxy: Remote DoS via unbounded TCP upstream buffering...

Low Photon OS Security Update - PHSA-2025-4.0-0911

Updates of 'openssh' packages of Photon OS have been released...

TencentOS Server 3: mingw packages (TSSA-2022:0121)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2022:0121 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @antonyfaris/prefix-node-builtins (>=1.0.0, <=1.0.1) +28 more potentially affected by CVE-2025-64757 via astro (>=5.0.0-beta.5, <=5.14.1)

astro NPM version =5.0.0-beta.5, =0.0.1, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =2.18.7, =1.25.426-4, =0.6.2, =0.1.2-alpha.1, =0.0.0-dev-20250414184926, =1.13.2, =0.0.1, =0.0.1, =1.0.21, =1.0.22 and more Source cves: CVE-2025-64757 Source advisory: SNYK:JS-ASTRO-14059139...