MAL-2025-27829 Malicious code in npm-download-counts-v2 (npm)

The package npm-download-counts-v2 was found to contain malicious code...

SUSE-SU-2025:02592-1 Security update for cosign

This update for cosign fixes the following issues: Update to version 2.5.3 jscSLE-23879: - CVE-2025-46569: Fixed OPA server Data API HTTP path injection of Rego bsc1246725 Changelog: Update to 2.5.3: - Add signing-config create command 4280 - Allow multiple services to be specified for trusted-ro...

CVE-2025-7745

Buffer Over-read vulnerability in ABB AC500 V2.This issue affects AC500 V2: through 2.5.2...

CVE-2025-7745 Modbus TCP buffer overread

Buffer Over-read vulnerability in ABB AC500 V2.This issue affects AC500 V2: through 2.5.2...

CVE-2025-7745 Modbus TCP buffer overread

Buffer Over-read vulnerability in ABB AC500 V2.This issue affects AC500 V2: through 2.5.2...

PT-2025-30638

Name of the Vulnerable Software and Affected Versions ABB AC500 V2 versions through 2.5.2 Description A buffer over-read issue exists in ABB AC500 V2. This can potentially lead to unexpected system behavior. Recommendations Update ABB AC500 V2 to a version later than 2.5.2...

CVE-2025-7724 Unauthenticated command injection on VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2

An unauthenticated OS command injection vulnerability exists in VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2.This issue affects VIGI NVR1104H-4P V1: before 1.1.5 Build 250518; VIGI NVR2016H-16MP V2: before 1.3.1 Build 250407...

CVE-2025-7724 Unauthenticated command injection on VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2

An unauthenticated OS command injection vulnerability exists in VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2.This issue affects VIGI NVR1104H-4P V1: before 1.1.5 Build 250518; VIGI NVR2016H-16MP V2: before 1.3.1 Build 250407...

CVE-2025-7723

CVE-2025-7723 affects TP-Link VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2. The OS command injection vulnerability can be exploited after authentication, with affected builds: V1 before 1.1.5 (Build 250518) and V2 before 1.3.1 (Build 250407). Related vendor advisories (JPN/JP and PTSecurity) cor...

CVE-2025-7723 Authenticated command injection on VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2

A command injection vulnerability exists that can be exploited after authentication in VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2.This issue affects VIGI NVR1104H-4P V1: before 1.1.5 Build 250518; VIGI NVR2016H-16MP V2: before 1.3.1 Build 250407...

microcode_ctl: From CVEorg collector

New Spectre-v2 attack classes have been discovered within CPU architectures that enable self-training exploitation of speculative execution within the same privilege domain. These novel techniques bypass existing hardware and software mitigations, including IBPB, eIBRS, and BHINO, by leveraging...

Malicious code in spl-token-v2 (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e11bf75d7bf296658cc93ae700f5656d24c455151b1cb8db46389ec375fbc286 Any computer that has this package installed or running should be considered...

MAL-2025-6127 Malicious code in spl-token-v2 (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e11bf75d7bf296658cc93ae700f5656d24c455151b1cb8db46389ec375fbc286 Any computer that has this package installed or running should be considered...

Malicious code in dex-core-v2 (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 43ea4e0d3d0e8d1d1bedac44fc35d275146740cdf21e51a4328174bc6304e064 Any computer that has this package installed or running should be considered...

MAL-2025-5770 Malicious code in dex-core-v2 (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 43ea4e0d3d0e8d1d1bedac44fc35d275146740cdf21e51a4328174bc6304e064 Any computer that has this package installed or running should be considered...

TAG-140 Deploys DRAT V2 RAT, Targeting Indian Government, Defense, and Rail Sectors

A hacking group with ties other than Pakistan has been found targeting Indian government organizations with a modified variant of a remote access trojan RAT called DRAT. The activity has been attributed by Recorded Future's Insikt Group to a threat actor tracked as TAG-140, which it said overlaps...

PT-2025-33780

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The Linux kernel contains a flaw in the RDMA/hns subsystem where rsv qp may be double destroyed during an error condition. This occurs first in free mr init and then in hns roce exit...

Malicious code in n8n-nodes-zalo-user-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b5b947fc267d5c40a50dc48860ddebb3d7ab7b78e58d65e0b97ddec970698856 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5605 Malicious code in n8n-nodes-zalo-user-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b5b947fc267d5c40a50dc48860ddebb3d7ab7b78e58d65e0b97ddec970698856 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-39137

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains an issue within the libceph component related to invalid accesses to ceph connection v1 info. Specifically, generic code in messenger.c reads and writes to the...