Template Secret leakage in logs in Scaffolder when using `fetch:template`

A logging flaw in Backstage Scaffolder’s fetch:template action up to @backstage/plugin-scaffolder-backend 2.1.0 may write template secrets to logs. The action emitted a duplicate, pre-redaction copy of input parameters, so values provided via the secrets bag could appear in local/server logs when...

CVE-2025-55285 @backstage/plugin-scaffolder-backend Template Secret Leakage in Logs in Scaffolder When Using `fetch:template`

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly redacted. If $ secrets.x is not passed...

Security update for go1.23-openssl

This update for go1.23-openssl fixes the following issues: Updated to go1.23.12 released 2025-08-06 bsc1229122: - CVE-2025-4674: Fixed unexpected command execution in untrusted VCS repositories in cmd/go bsc1246118 - CVE-2025-47906: Fixed incorrect expansion of "", "." and ".." in some PATH...

OESA-2025-2004 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: net: allow small head cache usage with large MAXSKBFRAGS values Sabrina reported the following splat: WARNING: CPU: 0 PID: 1 at net/core/dev.c:6935...

Microsoft Word Code Execution Vulnerability (CNVD-2025-18817)

Microsoft Word is a word processing software in the Office suite of the U.S. company Microsoft Microsoft. A code execution vulnerability exists in Microsoft Word, which is caused due to a post-release usage error when opening a specially crafted file. An attacker could exploit this vulnerability ...

Linux Distros Unpatched Vulnerability : CVE-2022-50142

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: intelth: msu: Fix vmalloced buffers After commit f5ff79fddf0e dma-mapping: remove...

Linux Distros Unpatched Vulnerability : CVE-2024-56743

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: nfscommon: must not hold RCU while calling nfsdfileputlocal Move holding the RCU from...

Linux Distros Unpatched Vulnerability : CVE-2025-38408

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - genirq/irqsim: Initialize work context pointers properly Initialize ops member's pointers properly by using kzalloc instead of kmalloc when allocating the...

Linux Distros Unpatched Vulnerability : CVE-2024-45159

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Mbed TLS 3.x before 3.6.1. With TLS 1.3, when a server enables optional authentication of the client, if the client-provided...

Linux Distros Unpatched Vulnerability : CVE-2025-46805

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Screen version 5.0.0 and older version 4 releases have a TOCTOU race potentially allowing to send SIGHUP, SIGCONT to privileged processes when installed...

Linux Distros Unpatched Vulnerability : CVE-2022-22748

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Malicious websites could have confused Firefox into showing the wrong origin when asking to launch a program and handling an external URL protocol. This...

Malicious code in usage-tracker-public (npm)

The package usage-tracker-public was found to contain malicious code...

MAL-2025-12477 Malicious code in @zalastax/nolb-muw (npm)

The package @zalastax/nolb-muw was found to contain malicious code...

MAL-2025-9043 Malicious code in @malware-test-usage-civvy-aurum-narre/test-mlw3-usage-civvy-aurum-narre (npm)

The package @malware-test-usage-civvy-aurum-narre/test-mlw3-usage-civvy-aurum-narre was found to contain malicious code...

MAL-2025-28498 Malicious code in ort-rn-basic-usage (npm)

The package ort-rn-basic-usage was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...

MAL-2025-14647 Malicious code in api-usage_create-tensor (npm)

The package api-usagecreate-tensor was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...

MAL-2025-37960 Malicious code in usage-tracker-public (npm)

The package usage-tracker-public was found to contain malicious code...

MAL-2025-23252 Malicious code in installments (npm)

The package installments was found to contain malicious code...

Malicious code in ort-rn-basic-usage (npm)

The package ort-rn-basic-usage was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...

Rockwell Automation Studio 5000 Logix Designer

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to crash the device or execute malicious code. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network...