MAL-2025-44936 Malicious code in kurnia-mieayam59-kyuki (npm)

The package kurnia-mieayam59-kyuki was found to contain malicious code...

MAL-2025-43861 Malicious code in coin-master-unlimited-free-spins-leld62 (npm)

The package coin-master-unlimited-free-spins-leld62 was found to contain malicious code...

MAL-2025-43367 Malicious code in @zalastax/nolb-passpi (npm)

The package @zalastax/nolb-passpi was found to contain malicious code...

CVE-2025-50087 affecting package mysql for versions less than 8.0.43-1

CVE-2025-50087 affecting package mysql for versions less than 8.0.43-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-50079 affecting package mysql for versions less than 8.0.43-1

CVE-2025-50079 affecting package mysql for versions less than 8.0.43-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-38694

In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090prwonapb In dib7090prwonapb, msg is controlled by user. When msg0.buf is null and msg0.len is zero, former checks on msg0.buf would be passed. If accessing msg0.buf2...

Moderate: Red Hat Security Advisory: python3.12 security update

An update for python3.12 is now available for Red Hat Enterprise Linux 9.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...

Improper handling of special tags within script contexts in html/template

...

Improper handling of empty HTML attributes in html/template

...

vfio/fsl-mc: Block calling interrupt handler without trigger

...

PT-2025-36104

Name of the Vulnerable Software and Affected Versions: ZF FROST versions 2.0.0 through 2.1.0 Description: ZF FROST is a Rust implementation of FROST Flexible Round-Optimised Schnorr Threshold signatures. Refresh shares with smaller min signers values in versions 2.0.0 through 2.1.0 can reduce...

aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators

...

Rejected reason: This was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap’s security model, and the associated CVE has been rescinded.

...

The sideband payload is passed unfiltered to the terminal in git

...

CVE-2025-2416

creationtimestamp| type| source ---|---|--- 2025-09-03 14:39:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lxwue45i5r2r...

cJSON 安全漏洞

cJSON is a lightweight open source JSON parser from the individual developer Dave Gamble. A security vulnerability exists in cJSON version 1.7.18 and earlier, which stems from an out-of-bounds access vulnerability in the decodearrayindexfrompointer function that could lead to bypassing array boun...

ASB-A-299928772

In validateUriSchemeAndPermission of DisclaimersParserImpl.java , there is a possible way to access data from another user due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

ASB-A-419014146

Bulletin has no description...

CVE-2011-2432

creationtimestamp| type| source ---|---|--- 2025-08-31 03:01:23+00:00| seen| MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d 2025-08-31 03:12:55+00:00| seen| MISP/d17bd6ef-d68b-317b-ac33-cdbc44c5fc57...

Tracing logging user input may result in poisoning logs with ANSI escape sequences

Impact Previous versions of tracing-subscriber were vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to: - Manipulate terminal title bars - Clear screens o...