EUVD-2024-41605

Malicious code in bioql PyPI...

EUVD-2023-3277

Malicious code in bioql PyPI...

EUVD-2024-19964

Malicious code in bioql PyPI...

EUVD-2022-38830

Malicious code in bioql PyPI...

EUVD-2022-32382

Malicious code in bioql PyPI...

EUVD-2024-54485

Malicious code in bioql PyPI...

EUVD-2024-39635

Malicious code in bioql PyPI...

EUVD-2022-7302

Malicious code in bioql PyPI...

CVE-2025-59933

libvips is a demand-driven, horizontally threaded image processing library. For versions 8.17.1 and below, when libvips is compiled with support for PDF input via poppler, the pdfload operation is affected by a buffer read overflow when parsing the header of a crafted PDF with a page that defines...

Security update for podman

This update for podman fixes the following issues: CVE-2025-6032: Fixed machine init command failing to verify TLS certificate bsc1245320 Fix conditional Requires remove deprecated sleversion macro Update to version 5.4.2: Add release notes for v5.4.2 Fix a potential deadlock during podman cp...

rke2-1.33-1.33.5+rke2r1-1.1 on GA media (moderate)

rke2-1.33-1.33.5+rke2r1-1.1 on GA media Announcement ID: openSUSE-SU-2025:15569-1 Rating: moderate Cross-References: CVE-2025-1974 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...

CVE-2025-10619

A vulnerability was detected in sequa-ai sequa-mcp up to 1.0.13. This affects the function redirectToAuthorization of the file src/helpers/node-oauth-client-provider.ts of the component OAuth Server Discovery. Performing manipulation results in os command injection. Remote exploitation of the...

PT-2025-38372

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.1.0-rc4 for upstream base 2022 11 10 16 12 1 Description A flaw exists in the Linux kernel's RDMA/mlx5 subsystem related to the handling of port numbers within the mlx5 ib get hw stats function. Specifically,...

PT-2025-38233

Name of the Vulnerable Software and Affected Versions: CISA Thorium versions prior to 1.1.2 Description: CISA Thorium does not validate TLS certificates when connecting to Elasticsearch. This allows an unauthenticated attacker with access to a Thorium cluster to impersonate the Elasticsearch...

GHSA-9G9J-RGGX-7FMG [email protected] contains malware after npm account takeover

Impact On 8 September 2025, the npm publishing account for simple-swizzle was taken over after a phishing attack. Version 0.2.3 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker'...

CVE-2025-59330

error-ex allows error subclassing and stack customization. On 8 September 2025, an npm publishing account for error-ex was taken over after a phishing attack. Version 1.3.3 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect...

Fedora 43 : cef (2025-6e40c0957f)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-6e40c0957f advisory. - Update to 139.0.7258.154 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested...

PT-2025-37402

Name of the Vulnerable Software and Affected Versions: CRMEB versions prior to 5.6.1 Description: A security issue exists in CRMEB that allows for server-side request forgery. The testOutUrl function within the app/services/out/OutAccountServices.php file is affected. Manipulation of the push tok...

Fedora 43 : chromium (2025-e8d34c61f8)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-e8d34c61f8 advisory. Update to 140.0.7339.80 CVE-2025-9864: Use after free in V8 CVE-2025-9865: Inappropriate implementation in Toolbar CVE-2025-9866: Inappropriate...

CVE-2025-59058

httpsig-rs is a Rust implementation of IETF RFC 9421 http message signatures. Prior to version 0.0.19, the HMAC signature comparison is not timing-safe. This makes anyone who uses HS256 signature verification vulnerable to a timing attack that allows the attacker to forge a signature. Version...