CVE-2025-38546 atm: clip: Fix memory leak of struct clip_vcc.

In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix memory leak of struct clipvcc. ioctlATMARPMKIP allocates struct clipvcc and set it to vcc-userback. The code assumes that vccdestroysocket passes NULL skb to vcc-push when the socket is closed, and then clippush...

CVE-2025-50861

The Lotus Cars Android app com.lotus.carsdomestic.intl 1.2.8 contains an exported component, PushDeepLinkActivity, which is accessible without authentication via ADB or malicious apps. This poses a risk of unintended access to application internals and can cause denial of service or logic abuse...

Linux Distros Unpatched Vulnerability : CVE-2018-12387

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in the stack pointer being off by 8 bytes...

Linux Distros Unpatched Vulnerability : CVE-2023-0394

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A NULL pointer dereference flaw was found in rawv6pushpendingframes in net/ipv6/raw.c in the network subcomponent in the Linux kernel. This flaw causes the syst...

Malicious code in deploytool-git-push (npm)

The package deploytool-git-push was found to contain malicious code...

Malicious code in server-push-webpack-plugin (npm)

The package server-push-webpack-plugin was found to contain malicious code...

MAL-2025-33005 Malicious code in server-push-webpack-plugin (npm)

The package server-push-webpack-plugin was found to contain malicious code...

MAL-2025-18297 Malicious code in deploytool-git-push (npm)

The package deploytool-git-push was found to contain malicious code...

CVE-2025-50155

Access of resource using incompatible type 'type confusion' in Windows Push Notifications allows an authorized attacker to elevate privileges locally...

CVE-2025-53725

Access of resource using incompatible type 'type confusion' in Windows Push Notifications allows an authorized attacker to elevate privileges locally...

CVE-2025-53724

Access of resource using incompatible type 'type confusion' in Windows Push Notifications allows an authorized attacker to elevate privileges locally...

CVE-2025-53726

Access of resource using incompatible type 'type confusion' in Windows Push Notifications allows an authorized attacker to elevate privileges locally...

CVE-2025-54864

Hydra is a continuous integration service for Nix based projects. Prior to commit f7bda02, /api/push-github and /api/push-gitea are called by the corresponding forge without HTTP Basic authentication. Both forges do however feature HMAC signing with a secret key. Triggering an evaluation can be...

CVE-2025-50861

The Lotus Cars Android app (com.lotus.carsdomestic.intl) version 1.2.8 contains an exported component, PushDeepLinkActivity , which is accessible without authentication via ADB or malicious apps. This vulnerability allows for unintended access to application internals, potentially leading to deni...

The vulnerability of the clip_push() function in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the clippush function in the Linux operating system’s kernel is related to an uncontrolled recursion. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2025-35500

The safe API array queue::ArrayQueue::push front can lead to deallocating uninitialized memory if a panic occurs while invoking the clone method on the passed argument. Specifically, push front receives an argument that is intended to be cloned and pushed, whose type implements the Clone trait...

CVE-2025-55196 External Secrets Operator Missing Namespace Restriction in PushSecret and SecretStore List() Calls Allows Unauthorized Secret Access

External Secrets Operator is a Kubernetes operator that integrates external secret management systems. From version 0.15.0 to before 0.19.2, a vulnerability was discovered where the List calls for Kubernetes Secret and SecretStore resources performed by the PushSecret controller did not apply a...

CVE-2025-55196 External Secrets Operator Missing Namespace Restriction in PushSecret and SecretStore List() Calls Allows Unauthorized Secret Access

External Secrets Operator is a Kubernetes operator that integrates external secret management systems. From version 0.15.0 to before 0.19.2, a vulnerability was discovered where the List calls for Kubernetes Secret and SecretStore resources performed by the PushSecret controller did not apply a...

Malicious File Parsing

@finos/git-proxy is vulnerable to malicious file parsing. The vulnerability is due to improper PACK signature detection in parsePush.ts, which allows an attacker to embed misleading signatures in commit content and craft packet structures to bypass approval or hide commits...

PT-2025-33101

Name of the Vulnerable Software and Affected Versions: External Secrets Operator versions 0.15.0 through 0.19.1 Description: A flaw was discovered in the External Secrets Operator where List calls for Kubernetes Secret and SecretStore resources performed by the PushSecret controller did not apply...