Malicious Package

Overview @morphodao/morpho-core-v1 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

LimonDesk 访问控制错误漏洞

LimonDesk is a real-time chat, work order ticketing, and other features from LimonDesk, a Turkish company. An access control error vulnerability exists in LimonDesk s1.02.14 through versions prior to v1.ylabel17, which stems from a source validation error that could lead to forced browsing...

LimonDesk 安全漏洞

LimonDesk is a real-time chat, work order ticketing, and other features from LimonDesk Turkey. A security vulnerability exists in LimonDesk s1.02.14 through versions prior to v1.ylabel17, which stems from an improperly restricted rendering UI layer or frame, which could lead to iframe overrides a...

Linux Distros Unpatched Vulnerability : CVE-2018-16393

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Several buffer overflows when handling responses from a Gemsafe V1 Smartcard in gemsafegetcertlen in libopensc/pkcs15-gemsafeV1.c in OpenSC before 0.19.0-rc1...

Linux Distros Unpatched Vulnerability : CVE-2023-52997

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv4: prevent potential spectre v1 gadget in ipmetricsconvert if !type continue; if type RTAXMAX return -EINVAL; ... metricstype - 1 = val; @type being used as ...

as-design-v1 (=1.0.0) potentially affected by unknown CVE via preinstall (=0.0.1-security)

preinstall NPM version =0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on preinstall and may be impacted: - as-design-v1 =1.0.0 Source cves: unknown CVE Source advisory: OSV:MAL-2025-29612...

CVE-2025-7724 Unauthenticated command injection on VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2

An unauthenticated OS command injection vulnerability exists in VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2.This issue affects VIGI NVR1104H-4P V1: before 1.1.5 Build 250518; VIGI NVR2016H-16MP V2: before 1.3.1 Build 250407...

CVE-2025-7724 Unauthenticated command injection on VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2

An unauthenticated OS command injection vulnerability exists in VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2.This issue affects VIGI NVR1104H-4P V1: before 1.1.5 Build 250518; VIGI NVR2016H-16MP V2: before 1.3.1 Build 250407...

CVE-2025-7723 Authenticated command injection on VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2

A command injection vulnerability exists that can be exploited after authentication in VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2.This issue affects VIGI NVR1104H-4P V1: before 1.1.5 Build 250518; VIGI NVR2016H-16MP V2: before 1.3.1 Build 250407...

CVE-2025-7723

CVE-2025-7723 affects TP-Link VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2. The OS command injection vulnerability can be exploited after authentication, with affected builds: V1 before 1.1.5 (Build 250518) and V2 before 1.3.1 (Build 250407). Related vendor advisories (JPN/JP and PTSecurity) cor...

SUSE CVE-2025-38266

In the Linux kernel, the following vulnerability has been resolved: pinctrl: mediatek: eint: Fix invalid pointer dereference for v1 platforms Commit 3ef9f710efcb "pinctrl: mediatek: Add EINT support for multiple addresses" introduced an access to the 'soc' field of struct mtkpinctrl in...

CVE-2025-38266

In the Linux kernel, the following vulnerability has been resolved: pinctrl: mediatek: eint: Fix invalid pointer dereference for v1 platforms Commit 3ef9f710efcb "pinctrl: mediatek: Add EINT support for multiple addresses" introduced an access to the 'soc' field of struct mtkpinctrl in...

CVE-2025-38266 pinctrl: mediatek: eint: Fix invalid pointer dereference for v1 platforms

In the Linux kernel, the following vulnerability has been resolved: pinctrl: mediatek: eint: Fix invalid pointer dereference for v1 platforms Commit 3ef9f710efcb "pinctrl: mediatek: Add EINT support for multiple addresses" introduced an access to the 'soc' field of struct mtkpinctrl in...

Malicious code in lz-evm-sdk-v1 (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 171ea15aa901dba5305f361a9f0a2958fcbe7926518fa9f2467bf687b3a18c13 Any computer that has this package installed or running should be considered...

MAL-2025-5788 Malicious code in lz-evm-sdk-v1 (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 171ea15aa901dba5305f361a9f0a2958fcbe7926518fa9f2467bf687b3a18c13 Any computer that has this package installed or running should be considered...

PT-2025-39137

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains an issue within the libceph component related to invalid accesses to ceph connection v1 info. Specifically, generic code in messenger.c reads and writes to the...

kernel: dm ioctl: prevent potential spectre v1 gadget

A vulnerability was found in the Linux kernel's dm-ioctl interface in the lookupioctl function, which accepts a user-provided cmd value that is used to index the ioctls array directly. This issue could lead to an out-of-bounds access if the CPU speculatively executes the array access before cmd i...

RHEL 8 : kernel (RHSA-2025:10005)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10005 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Bluetooth: Fix use after free...

Langchain-Chatchat vulnerable to path traversal

A vulnerability, which was classified as critical, has been found in chatchat-space Langchain-Chatchat up to 0.3.1. This issue affects some unknown processing of the file /v1/file. The manipulation of the argument flag leads to path traversal. The exploit has been disclosed to the public and may ...

CVE-2022-50103 sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed

In the Linux kernel, the following vulnerability has been resolved: sched, cpuset: Fix dlcpubusy panic due to empty cs-cpusallowed With cgroup v2, the cpuset's cpusallowed mask can be empty indicating that the cpuset will just use the effective CPUs of its parent. So cpusetcanattach can call...