DEBIAN-CVE-2025-62291

In the eap-mschapv2 plugin client-side in strongSwan before 6.0.3, a malicious EAP-MSCHAPv2 server can send a crafted message of size 6 through 8, and cause an integer underflow that potentially results in a heap-based buffer overflow...

DEBIAN-CVE-2025-61873

Best Practical Request Tracker RT before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via ticket values when TSV export is used...

CVE-2021-47845 Spy Emergency 25.0.650 - Unquoted Service Path

Spy Emergency 25.0.650 contains an unquoted service path vulnerability in its Windows service configurations that allows local attackers to execute code with elevated privileges. Attackers can exploit the unquoted file paths in SpyEmergencyHealth.exe and SpyEmergencySrv.exe to inject malicious co...

DEBIAN-CVE-2025-43904

In SchedMD Slurm before 24.11.5, 24.05.8, and 23.11.11, the accounting system can allow a Coordinator to promote a user to Administrator...

DEBIAN-CVE-2025-31510

In the portal in LemonLDAP::NG before 2.21.0, cross-site scripting XSS allows remote attackers to inject arbitrary web script or HTML into the login page via the tab parameter, for Choice authentication...

DEBIAN-CVE-2025-24528

In MIT Kerberos 5 aka krb5 before 1.22 with incremental propagation, there is an integer overflow for a large update size to resize in kdblog.c. An authenticated attacker can cause an out-of-bounds write and kadmind daemon crash...

CVE-2025-15032

Dia for macOS before 1.9.0 is vulnerable to spoofing of the window title due to a missing about:blank indicator in custom-sized new windows. The root cause is the absence of a visual cue (about:blank indicator) that can mislead users about the current site. Affected product: Dia (macOS). Impact: ...

CVE-2026-0949

CVE-2026-0949 describes a stored XSS in PEM versions

CVE-2025-68921

SteelSeries Nahimic 3 1.10.7 allows Directory traversal...

CVE-2026-22646

Certain error messages returned by the application expose internal system details that should not be visible to end users, providing attackers with valuable reconnaissance information like file paths, database errors, or software versions that can be used to map the application's internal structu...

Five Malicious Chrome Extensions Impersonate Workday and NetSuite to Hijack Accounts

Cybersecurity researchers have discovered five new malicious Google Chrome web browser extensions that masquerade as human resources HR and enterprise resource planning ERP platforms like Workday, NetSuite, and SuccessFactors to take control of victim accounts. "The extensions work in concert to...

CVE-2026-0615

The Librarian supervisord status page can be retrieved by the webfetch tool, which can be used to retrieve running processes within TheLibrarian backend. The vendor has fixed the vulnerability in all affected versions...

BELL-CVE-2025-71090

Bulletin has no description...

Cisco Patches Zero-Day RCE Exploited by China-Linked APT in Secure Email Gateways

Cisco on Thursday released security updates for a maximum-severity security flaw impacting Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager, nearly a month after the company disclosed that it had been exploited as a zero-day by a China-nexus advanced...

CVE-2025-70299

A heap overflow in the aviparseinputfile function of GPAC v2.4.0 allows attackers to cause a Denial of Service DoS via a crafted AVI file...

CVE-2021-47779

Dolibarr ERP-CRM 14.0.2 contains a stored cross-site scripting vulnerability in the ticket creation module that allows low-privilege users to inject malicious scripts. Attackers can craft a specially designed ticket message with embedded JavaScript that triggers when an administrator copies the...

Malicious code in vue_frontend_rpc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37b3b39f0c20a8dd65bccdba671ecc5761e03146f454226847e982c424b8c25b The package vuefrontendrpc was found to contain malicious code. Source: ghsa-malware 30e31020ae5911a45b568d33238a4785bb2149dc1a8b474ac220aacb60546551...

Malicious code in presentation-test-utilities (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b481e6b9e82f740ebadaad84b281196fae93b52b14c302f7763234319c732f3e The package presentation-test-utilities was found to contain malicious code. Source: ghsa-malware...

MAL-2026-313 Malicious code in spire.officejs-fonts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85e04f3e2745bb2e3fd9eac19b0b9c45ad94c1ead97c8a9a4a1db6d412bd39eb The package spire.officejs-fonts was found to contain malicious code...

Malicious code in @ux-foundry/palette (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddd18fdf82036fc2f39aba4198fb081eb4cb5683f9b9308bdb2a0f8539c54275 The package @ux-foundry/palette was found to contain malicious code. Source: ghsa-malware...