16469 matches found
CVE-2025-38696 MIPS: Don't crash in stack_top() for tasks without ABI or vDSO
In the Linux kernel, the following vulnerability has been resolved: MIPS: Don't crash in stacktop for tasks without ABI or vDSO Not all tasks have an ABI associated or vDSO mapped, for example kthreads never do. If such a task ever ends up calling stacktop, it will derefence the NULL ABI pointer...
In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a "verification DoS."
...
Large RSA keys can cause high CPU usage in crypto/tls
...
Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo).
...
Excessive resource consumption in net/http, net/textproto and mime/multipart
...
net: allow small head cache usage with large MAX_SKB_FRAGS values
...
rv: Use strings in da monitors tracepoints
...
Malicious Package
Overview mathy-console is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious Package
Overview tailwind-react-icon is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
PT-2025-35896
Name of the Vulnerable Software and Affected Versions langchain-ai/langchain version 0.3.63 Description The EverNoteLoader component is susceptible to XML External Entity XXE attacks due to insecure XML parsing. This issue stems from the use of etree.iterparse without disabling external entity...
In Netwide Assembler (NASM) 2.14.02, stack consumption occurs in expr# functions in asm/eval.c. This potentially affects the relationships among expr0, expr1, expr2, expr3, expr4, expr5, and expr6 (and stdscan in asm/stdscan.c). This is similar to CVE-2019-6290 and CVE-2019-6291.
...
CVE-2025-57833
An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the kwargs passed QuerySet.annotate or QuerySet.alias...
XWiki configuration files can be accessed through the webjars API
Impact It's possible to get access and read configuration files by using URLs such as http://localhost:8080/xwiki/webjars/wiki%3Axwiki/..%2F..%2F..%2F..%2F..%2FWEB-INF%2Fxwiki.cfg. The trick here is to encode the / which is decoded when parsing the URL segment, but not re-encoded when assembling...
What Is a Passkey? Here’s How to Set Up and Use Them (2025)
Passkeys were built to enable a password-free future. Here's what they are and how you can start using them...
Linux Distros Unpatched Vulnerability : CVE-2019-9423
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In opencv calls that use libpng, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no...
Linux Distros Unpatched Vulnerability : CVE-2023-0821
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HashiCorp Nomad and Nomad Enterprise 1.2.15 up to 1.3.8, and 1.4.3 jobs using a maliciously compressed artifact stanza source can cause excessive disk usage...
Shadow AI Discovery: A Critical Part of Enterprise AI Governance
The Harsh Truths of AI Adoption MITs State of AI in Business report revealed that while 40% of organizations have purchased enterprise LLM subscriptions, over 90% of employees are actively using AI tools in their daily work. Similarly, research from Harmonic Security found that 45.4% of sensitive...
Exploit for Inefficient Regular Expression Complexity in Jqueryvalidation Jquery_Validation
PoC exploit for CVE-2022-31147, a path traversal flaw in matthia...
kernel: scsi: lpfc: Use memcpy() for BIOS version
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Use memcpy for BIOS version The strlcat with FORTIFY support is triggering a panic because it thinks the target buffer will overflow although the correct target buffer size is passed in. Anyway, instead of memset with...
PT-2025-40631
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory corruption issue exists in the sma1307 setting loaded function within the ASoC codec for the sma1307 device. The issue stems from an incorrect memory allocation size for the...