TencentOS Server 4: microcode_ctl (TSSA-2025:0703)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0703 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Linux Distros Unpatched Vulnerability : CVE-2022-26363

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - x86 pv: Insufficient care with non-coherent mappings This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities...

CVE-2025-57810

CVE-2025-57810 affects the jsPDF library. The issue arises when user control of the first argument to addImage allows untrusted image data/URLs to trigger high CPU usage, leading to denial of service. This vulnerability is present in versions prior to 3.0.2 and was fixed in jsPDF 3.0.2. Impact is...

Regular Expression Denial Of Service (ReDoS)

Hugging Face Transformers is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to the use of a regex pattern /^/^// in the converttfweightnametoptweightname function, which allows attackers to craft malicious input strings causing catastrophic backtracking and...

jsPDF 安全漏洞

jsPDF is Parallax open source a JavaScript-based PDF document generation library . A security vulnerability exists in versions prior to jsPDF 3.0.2, which stems from the addImage method not adequately validating input, which could lead to CPU resource exhaustion and denial of service attacks...

SUSE-SU-2025:02970-1 Security update for pam

This update for pam fixes the following issues: - Improve previous CVE-2024-10041 fix which led to CPU performance issues bsc1232234...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes. The following security bugs were fixed: CVE-2024-36028: mm/hugetlb: fix DEBUGLOCKSWARNON1 when dissolvefreehugetlbfolio bsc1225707. CVE-2024-36348, CVE-2024-36349, CVE-2024-36350, CVE-2024-36357:...

jq 安全漏洞

jq is a lightweight and flexible command-line JSON processor from jqlang open source. A security vulnerability exists in jq 1.6 and earlier versions, which stems from a reachable assertion in the runjqtests function in the file jqtest.c. The vulnerability is caused by the presence of the jqtest.c...

Linux Distros Unpatched Vulnerability : CVE-2022-50173

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/msm/mdp5: Fix global state lock backoff We need to grab the lock after the early return...

Malicious code in code-processor (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-41376 Malicious code in code-processor (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in knowledge-processor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 10486375c2c8f9c47bdb66e84e96db62dd623c210713201b53ebd516834bf3e6 The OpenSSF Package Analysis project identified 'knowledge-processor' @ 99.0.9 npm as malicious. It is considered malicious because: - The packa...

MAL-2025-41302 Malicious code in knowledge-processor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 10486375c2c8f9c47bdb66e84e96db62dd623c210713201b53ebd516834bf3e6 The OpenSSF Package Analysis project identified 'knowledge-processor' @ 99.0.9 npm as malicious. It is considered malicious because: - The packa...

CVE-2011-10025

Subtitle Processor 7.7.1 contains a buffer overflow vulnerability in its .m3u file parser. When a crafted playlist file is opened, the application converts input to Unicode and copies it to a fixed-size stack buffer without proper bounds checking. This allows an attacker to overwrite the Structur...

CVE-2025-38640

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable migration in nfhookrunbpf. syzbot reported that the netfilter bpf prog can be called without migration disabled in xmit path. Then the assertion in bpfprogrun fails, triggering the splat below. 0 Let's use...

CVE-2025-38675 xfrm: state: initialize state_ptrs earlier in xfrm_state_find

In the Linux kernel, the following vulnerability has been resolved: xfrm: state: initialize stateptrs earlier in xfrmstatefind In case of preemption, xfrmstatelookat will find a different pcpuid and look up states for that other CPU. If we matched a state for CPU2 in the statecache while the look...

CVE-2025-38670

In the Linux kernel, the following vulnerability has been resolved: arm64/entry: Mask DAIF in cpuswitchto, callonirqstack cpuswitchto and callonirqstack manipulate SP to change to different stacks along with the Shadow Call Stack if it is enabled. Those two stack changes cannot be done atomically...

CVE-2025-38670 arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack()

In the Linux kernel, the following vulnerability has been resolved: arm64/entry: Mask DAIF in cpuswitchto, callonirqstack cpuswitchto and callonirqstack manipulate SP to change to different stacks along with the Shadow Call Stack if it is enabled. Those two stack changes cannot be done atomically...

CVE-2025-38640 bpf: Disable migration in nf_hook_run_bpf().

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable migration in nfhookrunbpf. syzbot reported that the netfilter bpf prog can be called without migration disabled in xmit path. Then the assertion in bpfprogrun fails, triggering the splat below. 0 Let's use...

CVE-2025-38640

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable migration in nfhookrunbpf. syzbot reported that the netfilter bpf prog can be called without migration disabled in xmit path. Then the assertion in bpfprogrun fails, triggering the splat below. 0 Let's use...