AZL-72403 CVE-2025-38387 affecting package kernel for versions less than 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Initialize objevent-objsublist before xainsert The objevent may be loaded immediately after inserted, then if the listhead is not initialized then we may get a poisonous pointer. This fixes the crash below: mlx5core...

DEBIAN-CVE-2025-38387

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Initialize objevent-objsublist before xainsert The objevent may be loaded immediately after inserted, then if the listhead is not initialized then we may get a poisonous pointer. This fixes the crash below: mlx5core...

[SECURITY] Fedora 41 Update: valkey-8.0.4-1.fc41

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing s...

Malicious code in @cpce/console-sub-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f0e227ba31b179597ff26830a069bf360d8ce9ea5fe6ec81f517bd159dbb5d10 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in @cpce/console-sub-app

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2025-27056

Memory corruption during sub-system restart while processing clean-up to free up resources...

CVE-2025-27056

CVE-2025-27056 describes a memory corruption issue that occurs during subsystem restart cleanup in a Qualcomm component (kernel-related). The available records indicate a local attacker could trigger memory corruption during the restart/cleanup phase, with potential impact on confidentiality, int...

Enhancing LLM Watermark Resilience against Both Scrubbing and Spoofing Attacks

Watermarking is a promising defense against the misuse of large language models LLMs, yet it remains vulnerable to scrubbing and spoofing attacks. This vulnerability stems from an inherent trade-off governed by watermark window size: smaller windows resist scrubbing better but are easier to...

CVE-2025-6511

A vulnerability classified as critical has been found in Netgear EX6150 1.0.0.461.0.76. This affects the function sub410090. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This...

CVE-2025-6292

A vulnerability has been found in D-Link DIR-825 2.03 and classified as critical. This vulnerability affects the function sub4091AC of the component HTTP POST Request Handler. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclos...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: bpf: Tracking the changespktdata property for global functions When processing calls to certain helpers, the verifier invalidates all packet pointers in the current state. For example, consider the following program: c...

[SECURITY] Fedora 42 Update: valkey-8.0.3-3.fc42

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing s...

[SECURITY] Fedora 41 Update: valkey-8.0.3-3.fc41

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing s...

Tenda CP3 注入漏洞

Tenda CP3 is a smart camera from Tenda, a Chinese company. A command injection vulnerability exists in Tenda CP3 version 11.10.00.2311090948, which stems from the failure of the function subF3C8C in the file apollo to correctly filter constructed command special characters, commands, and so on. A...

OESA-2025-1540 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: bpf: track changespktdata property for global functions When processing calls to certain helpers, verifier invalidates all packet pointers in a current state. Fo...

CVE-2024-49400

Tacquito prior to commit 07b49d1358e6ec0b5aa482fcd284f509191119e2 was not properly performing regex matches on authorized commands and arguments. Configured allowed commands/arguments were intended to require a match on the entire string, but instead only enforced a match on a sub-string. That...

CVE-2024-42681

Insecure Permissions vulnerability in xxl-job v.2.4.1 allows a remote attacker to execute arbitrary code via the Sub-Task ID component...

CVE-2023-30016

SQL Injection vulnerability in oretnom23 Judging Management System v1.0, allows remote attackers to execute arbitrary code and obtain sensitive information via subeventid parameter in subeventdetailsedit.php...

CVE-2023-0847

The Sub-IoT implementation of the DASH 7 Alliance protocol has a vulnerability that can lead to an out-of-bounds write prior to implementation version 0.5.0. If the protocol has been compiled using default settings, this will only grant the attacker access to allocated but unused memory. However,...

CVE-2023-3509

An issue has been discovered in GitLab affecting all versions before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. It was possible for group members with sub-maintainer role to change the title of privately accessible deploy keys associated...