Linux Distros Unpatched Vulnerability : CVE-2023-23602

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src header to be ignored. This could lead to...

Linux Distros Unpatched Vulnerability : CVE-2020-12387

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This resulted in a potentially exploitable crash. This...

CVE-2025-7205

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the donor notes parameter in all versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

Malicious Package

Overview indexer-worker-service is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

drupwn

This is an offensive tool for Drupal enumeration and exploitation. The tool, named Drupwn, is designed to automate Drupal information gathering and exploitation. It can be run in two modes: enum and exploit. The enum mode allows performing enumerations, while the exploit mode allows checking and...

CVE-2025-38358

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between async reclaim worker and closectree Syzbot reported an assertion failure due to an attempt to add a delayed iput after we have set BTRFSFSSTATENODELAYEDIPUT in the fsinfo state: WARNING: CPU: 0 PID: 65 at...

CVE-2025-38358 btrfs: fix race between async reclaim worker and close_ctree()

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between async reclaim worker and closectree Syzbot reported an assertion failure due to an attempt to add a delayed iput after we have set BTRFSFSSTATENODELAYEDIPUT in the fsinfo state: WARNING: CPU: 0 PID: 65 at...

CLSA-2025-1753207126 nginx: Fix of 2 CVEs

CVE-2022-41741: fix vulnerability in ngxhttpmp4module leading to potential memory corruption and termination by improving module handling of specially crafted audio/video files - CVE-2022-41742: fix module ngxhttpmp4module vulnerability to prevent worker process crash and memory disclosure from...

MAL-2025-6098 Malicious code in indexer-worker-service (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ac1787e896bcd8c295f599ea997c10b250926208aa47d4407a3b796c4033e349 Any computer that has this package installed or running should be considered...

page_pool: avoid infinite loop to schedule delayed worker

...

⚡ Weekly Recap: Chrome 0-Day, Ivanti Exploits, MacOS Stealers, Crypto Heists and More

Everything feels secure—until one small thing slips through. Even strong systems can break if a simple check is missed or a trusted tool is misused. Most threats don't start with alarms—they sneak in through the little things we overlook. A tiny bug, a reused password, a quiet connection—that's a...

PT-2025-33558

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A race condition exists between the spsc queue push function and the run-job worker, potentially causing job scheduling to halt and leading to hangs while waiting on DMA fences. This...

Identities of More Than 80 Americans Stolen for North Korean IT Worker Scams

The US Justice Department revealed the identity theft number along with one arrest and a crackdown on “laptop farms” that allegedly facilitate North Korean tech worker impersonators across the US...

SUSE CVE-2022-49974

In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: fix rumble worker null pointer deref We can dereference a null pointer trying to queue work to a destroyed workqueue. If the device is disconnected, nintendohidremove is called, in which the rumblequeue is destroye...

The vulnerability of the mac802154_scan_worker() function in the /net/mac802154/scan.c module of the Linux operating system allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the mac802154scanworker function in the /net/mac802154/scan.c module of the Linux kernel is related to the repeated use of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

CVE-2022-50070

In the Linux kernel, the following vulnerability has been resolved: mptcp: do not queue data on closed subflows Dipanjan reported a syzbot splat at close time: WARNING: CPU: 1 PID: 10818 at net/ipv4/afinet.c:153 inetsockdestruct+0x6d0/0x8e0 net/ipv4/afinet.c:153 Modules linked in: uioivshmemOE ui...

CVE-2022-49974

In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: fix rumble worker null pointer deref We can dereference a null pointer trying to queue work to a destroyed workqueue. If the device is disconnected, nintendohidremove is called, in which the rumblequeue is destroye...

Denial Of Service (DoS)

Salt is vulnerable to Denial Of Service DoS. The vulnerability is due to unsanitized input handling due to the pubret method using an unvalidated jid value to construct a file path, which can be exploited to cause worker process hangs through crafted read operations...

Security Bulletin: IBM Cloud Pak for Data is vulnerable to Improper Input Validation due to kube package ( CVE-2024-9042 )

Summary Potential vulnerabilities in kube package CVE-2024-9042 has been identified that may affect IBM Cloud Pak for Data. Vulnerability Details CVEID:CVE-2024-9042 DESCRIPTION: This CVE affects only Windows worker nodes. Your worker node is vulnerable to this issue if it is running one of the...

U.S. Seizes $7.74M in Crypto Tied to North Korea's Global Fake IT Worker Network

The U.S. Department of Justice DoJ said it has filed a civil forfeiture complaint in federal court that targets over $7.74 million in cryptocurrency, non-fungible tokens NFTs, and other digital assets allegedly linked to a global IT worker scheme orchestrated by North Korea. "For years, North Kor...