Deserialization of Untrusted Data

Overview mlrun is a Tracking and config of machine learning runs Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the importfunctiontodict function in the run.py file. Details Serialization is a process of converting an object into a sequence of bytes whic...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google. Google Android has a code execution vulnerability that can be exploited by an attacker to execute arbitrary code on the system...

SUSE SLES15: nv-prefer-signed-open-driver / etc (SUSE-SU-2025:03062-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03062-1 advisory. Updated CUDA variant to 580.65.06: - CVE-2025-23277: Fixed access memory outside bounds permitted under normal use cases in NVIDIA...

Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction

...

CLSA-2025-1756932191 buildah: Fix of CVE-2024-9407

CVE-2024-9407: validate input for bind-propagation option in Dockerfile RUN --mount instruction to prevent arbitrary parameter passing and potential file modification...

Release Information for Veeam ONE 13.0.1 Patch 1

Veeam ONE 13 Releases 13.0.2.6723 2026-05-27 What's New New Features and Improvements Suspicious Incremental Backup Size Alarm -- Extended Platform Support The Suspicious Incremental Backup Size alarm now covers all platforms supported in Veeam ONE v13, including Proxmox VE, oVirt KVM Oracle Linu...

Linux Distros Unpatched Vulnerability : CVE-2024-50636

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PyMOL 2.5.0 contains a vulnerability in its Run Script function, which allows the execution of arbitrary Python code embedded within .PYM files. Attackers can...

kernel: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()

In the Linux kernel, the following vulnerability has been resolved: bpf, testrun: Fix use-after-free issue in ethskbpkttype KMSAN reported a use-after-free issue in ethskbpkttype1. The cause of the issue was that ethskbpkttype accessed skb's data that didn't contain an Ethernet header. This occur...

Malicious code in actions-run-service (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0096c4c86f75bd5815b589d90393b9d5efa12ac9fdae99a2cb6293475de0cbf8 The OpenSSF Package Analysis project identified 'actions-run-service' @ 0.0.1.r2301dc6 rubygems as malicious. It is considered malicious because...

MAL-2025-46891 Malicious code in actions-run-service (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0096c4c86f75bd5815b589d90393b9d5efa12ac9fdae99a2cb6293475de0cbf8 The OpenSSF Package Analysis project identified 'actions-run-service' @ 0.0.1.r2301dc6 rubygems as malicious. It is considered malicious because...

VulnCheck KEV: CVE-2025-38352

Linux kernel contains a time-of-check time-of-use TOCTOU race condition vulnerability that has a high impact on confidentiality, integrity, and availability...

CVE-2025-53811

The configuration of Mosh-Pro on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code that inherits Mosh-Pro TCC Transparency, Consent, and Control permissions. Acquired resource access is limited to previously granted...

CVE-2025-58059 Valtimo scripting engine can be used to gain access to sensitive data or resources

Valtimo is a platform for Business Process Automation. In versions before 12.16.0.RELEASE, and from 13.0.0.RELEASE to before 13.1.2.RELEASE, any admin that can create or modify and execute process-definitions could gain access to sensitive data or resources. This includes but is not limited to:...

Valtimo scripting engine can be used to gain access to sensitive data or resources

Impact Any admin that can create or modify and execute process-definitions could gain access to sensitive data or resources. This includes but is not limited to: - Running executables on the application host - Inspecting and extracting data from the host environment or application properties -...

CVE-2025-30056

Technical details about CVE-2025-30056 are not provided in the connected documents. Monitor for updates to identify affected products, root cause, impact, and remediation.

CVE-2025-30056 Calling system commands via RunCommand

The RunCommand function accepts any parameter, which is then passed for execution in the shell. This allows an attacker to execute arbitrary code on the system...

kernel: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()

In the Linux kernel, the following vulnerability has been resolved: bpf, testrun: Fix use-after-free issue in ethskbpkttype KMSAN reported a use-after-free issue in ethskbpkttype1. The cause of the issue was that ethskbpkttype accessed skb's data that didn't contain an Ethernet header. This occur...

Linux Distros Unpatched Vulnerability : CVE-2019-7352

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Self - Stored Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, as the view 'state' aka Run State state.php does no input validation to the value...

Linux Distros Unpatched Vulnerability : CVE-2020-29668

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string except one from an expired cookie as the cookie...

GHSA-49GJ-C84Q-6QM9 Picklescan is missing detection when calling built-in python cProfile.run

Summary Using cProfile.run function, which is a built-in python library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to cProfile.run function in reduce method Then when the victim after checkin...