EUVD-2025-147990

Malicious code in tear-sdas-rc npm...

MAL-2025-154181 Malicious code in dajouka-scelas-rc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d2f38a3449ea54ac9a292683799d52e4f9b6eb0bcdcfeb1e35e297d1477d765 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dajouka-scelas-rc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d2f38a3449ea54ac9a292683799d52e4f9b6eb0bcdcfeb1e35e297d1477d765 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tear-grsass-rc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c0377406bb501ec4db1d72bc0638517db433489afb8d16925e2b42f1234bd0d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-147992

Malicious code in tear-rcbt-rc npm...

Malicious code in tear-slas-rc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aec940c8e6c7204eb4f93c58fa68cf01eb19e3dd74af78acbce4b397570c8a62 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-147991

Malicious code in tear-sas-rc npm...

Important: Red Hat Bug Fix Advisory: .NET 10.0 bug fix and enhancement update

An update for .NET 10.0 is now available for Red Hat Enterprise Linux 9. Please updateBug Fixes and Enhancements: Update .NET 10 to RC 1 rhel-9.7.z JIRA:RHEL-114572 Update .NET 10 to RC 2 rhel-9.7.z JIRA:RHEL-121559 dotnet10.0: .NET Denial of Service Vulnerability rhel-9.7.z JIRA:RHEL-120623...

CVE-2025-64323

kgateway is a Cloud-Native API and AI Gateway. Versions 2.0.4 and below and 2.1.0-agw-cel-rbac through 2.1.0-rc.2 lack authentication, allowing any client with unrestricted network access to the xDS port to retrieve potentially sensitive configuration data including certificate data, backend...

CVE-2025-64323

kgateway is a Cloud-Native API and AI Gateway. Versions 2.0.4 and below and 2.1.0-agw-cel-rbac through 2.1.0-rc.2 lack authentication, allowing any client with unrestricted network access to the xDS port to retrieve potentially sensitive configuration data including certificate data, backend...

CVE-2025-52881 runc: LSM labels can be bypassed with malicious config using dummy procfs files

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts we have also verified thi...

CVE-2025-52881

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts we have also verified thi...

AZL-70592 CVE-2025-31133 affecting package kubernetes for versions less than 1.30.10-16

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform sufficient verification that the source of the bind-mount i.e., the container's /dev/null was...

CVE-2025-31133

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform sufficient verification that the source of the bind-mount i.e., the container's /dev/null was...

PT-2025-45383

Name of the Vulnerable Software and Affected Versions Zitadel versions 4.0.0-rc.1 through 4.6.2 Description Zitadel is an open source identity management platform susceptible to secure Direct Object Reference IDOR attacks through its V2Beta API. Authenticated users with specific administrator rol...

PT-2025-45375

Name of the Vulnerable Software and Affected Versions runc version 1.2.7 runc version 1.3.2 runc version 1.4.0-rc.2 Description runc is a CLI tool for spawning and running containers according to the OCI specification. A race condition exists that allows an attacker to trick the tool into...

VulnCheck KEV: CVE-2025-32429

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an...

PT-2025-45348

Name of the Vulnerable Software and Affected Versions containerd versions 0.1.0 through 1.7.28 containerd versions 2.0.0-beta.0 through 2.0.6 containerd versions 2.1.0-beta.0 through 2.1.4 containerd versions 2.2.0-beta.0 through 2.2.0-rc.1 Description containerd is an open-source container runti...

CVE-2025-39993

In the Linux kernel, the following vulnerability has been resolved: media: rc: fix races with imondisconnect Syzbot reports a KASAN issue as below: BUG: KASAN: use-after-free in createpipe include/linux/usb.h:1945 inline BUG: KASAN: use-after-free in sendpacket+0xa2d/0xbc0...

CVE-2025-62378

CommandKit is the discord.js meta-framework for building Discord bots. In versions 1.2.0-rc.1 through 1.2.0-rc.11, a logic flaw exists in the message command handler that affects how the commandName property is exposed to both middleware functions and command execution contexts when handling...