MAL-2025-69439 Malicious code in misty-purple-parrot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb9bf7c6a1772970d1726a021ffca4b464e754a1c77f7ba18f0370a35c68723a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-59716

ownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the /apps/guests/register/email/token endpoint. Because of insufficient validation of the supplied token in showPasswordForm, the server responds differently when an e-mail address corresponds to a valid pending guest user...

CVE-2025-12677

The KiotViet Sync plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.5 via the registerapiroute function in kiotvietsync/includes/publicactions/WebHookAction.php. This makes it possible for unauthenticated attackers to extract the webhoo...

drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV

...

PT-2026-30155

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel's Bluetooth L2CAP implementation, specifically within the l2cap unregister user function. A race condition occurs because l2cap register user and l2cap...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990559)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990559 advisory. In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxxmdiosregister ofgetchildbyname returns a node...

CVE-2025-12677 KiotViet Sync <= 1.8.5 - Unauthenticated Webhook Key Exposure

The KiotViet Sync plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.5 via the registerapiroute function in kiotvietsync/includes/publicactions/WebHookAction.php. This makes it possible for unauthenticated attackers to extract the webhoo...

CVE-2025-12677

The KiotViet Sync WordPress plugin (versions up to and including 1.8.5) is vulnerable to Sensitive Information Exposure through register_api_route() in kiotvietsync/includes/public_actions/WebHookAction.php. Unauthenticated attackers can extract the webhook token value when configured. Public rep...

PT-2025-45141

Name of the Vulnerable Software and Affected Versions ownCloud Guests versions prior to 0.12.5 Description The application allows unauthenticated user enumeration through the /apps/guests/register/email/token API endpoint. Insufficient validation of the supplied token within the showPasswordForm...

CVE-2025-59716

The ownCloud Guests application, in versions prior to 0.12.5 , is vulnerable to unauthenticated user enumeration . The root cause is insufficient validation of the supplied token within the showPasswordForm function at the /apps/guests/register/{email}/{token} endpoint. An attacker can exploit th...

CVE-2025-59716: Exposure of Sensitive Information to an Unauthorized Actor

ownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the /apps/guests/register/email/token endpoint. Because of insufficient validation of the supplied token in showPasswordForm, the server responds differently when an e-mail address corresponds to a valid pending guest user...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989667)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989667 advisory. In the Linux kernel, the following vulnerability has been resolved: mISDN: fix possible memory leak in mISDNregisterdevice Afer commit 1fa5ae857bb1 driver core: get...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989558)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989558 advisory. In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix the error handling path in idxdcdevregister If a call to allocchrdevregion...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989863)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989863 advisory. In the Linux kernel, the following vulnerability has been resolved: ftrace: Clean up hash directfunctions on register failures We see the following GPF when...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988833)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988833 advisory. In the Linux kernel, the following vulnerability has been resolved: ftrace: Clean up hash directfunctions on register failures We see the following GPF when...

CVE-2025-59716

ownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the /apps/guests/register/email/token endpoint. Because of insufficient validation of the supplied token in showPasswordForm, the server responds differently when an e-mail address corresponds to a valid pending guest user...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-990230)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990230 advisory. In the Linux kernel, the following vulnerability has been resolved: l2tp: close all race conditions in l2tptunnelregister The code in l2tptunnelregister is racy in...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-989728)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989728 advisory. In the Linux kernel, the following vulnerability has been resolved: net: dsa: Fix possible memory leaks in dsaloopinit kmemleak reported memory leaks in dsaloopinit:...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989017)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989017 advisory. In the Linux kernel, the following vulnerability has been resolved: firmware: dmi-sysfs: Fix memory leak in dmisysfsregisterhandle kobjectinitandadd takes reference...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988849)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988849 advisory. In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix use-after-free bug in hclgevfsendmbxmsg Currently, the hns3remove function firstly...