MAL-2025-47661 Malicious code in example-custom-cart-method (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2025-60139: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Joovii Sendle Shipping official-sendle-shipping-method allows Cross Site Request Forgery.This issue affects Sendle Shipping: from n/a through = 6.02...

Security update for the Linux Kernel (Live Patch 49 for SLE 15 SP3)

This update for the Linux Kernel 5.3.18-15030059179 fixes several issues. The following security issues were fixed: CVE-2024-49860: ACPI: sysfs: validate return type of STR method bsc1231862. CVE-2025-38177: schhfsc: make hfscqlennotify idempotent bsc1246356. CVE-2025-38181: calipso: Fix...

PT-2025-39389

Name of the Vulnerable Software and Affected Versions cors-anywhere affected versions not specified Description Instances of cors-anywhere configured as an open proxy permit unauthenticated external users to initiate HTTP requests to arbitrary targets, leading to Server-Side Request Forgery SSRF...

CVE-2025-56769

The chinabugotech hutool library (specifically cn.hutool and hutool-extra) is vulnerable to Remote Code Execution (RCE) due to improper expression handling in the QLExpressEngine class. Attackers can submit crafted expressions to trigger arbitrary method invocations. A Proof of Concept (PoC) demo...

GHSA-2J4C-9QQQ-896R web3-core-method is vulnerable to prototype pollution

web3-core-method is a package designed to creates the methods on the web3 modules. A Prototype Pollution vulnerability in the attachToObject function of web3-core-method version 1.10.4 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing...

003-gas-convert (1.0.1), 0x-hunter-core (>=1.0.0-3, <=1.0.1-5) +6193 more potentially affected by CVE-2025-57329 via web3-core-method (>=1.0.0-beta.52, <=3.0.0-rc.5)

web3-core-method NPM version =1.0.0-beta.52, =1.0.0-3, =0.0.3, =0.0.3, =0.0.31, =1.1.0, =0.9.9, =0.1.0, =0.1.1 - 55tools-block 1.0.0 - 55tools-block-ext 1.0.0 - 84447xe5t8 1.0.0 and more Source cves: CVE-2025-57329 Source advisory: SNYK:JS-WEB3COREMETHOD-13110028...

web3-core-method is vulnerable to prototype pollution

web3-core-method is a package designed to creates the methods on the web3 modules. A Prototype Pollution vulnerability in the attachToObject function of web3-core-method version 1.10.4 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing...

0x-hunter-core (>=1.0.0-13, <=1.0.1-5), 0x-relayer-cat (>=0.0.3, <=0.0.10) +2128 more potentially affected by CVE-2025-57329 via web3-core-method (>=1.0.0-beta.52, <=1.10.3)

web3-core-method NPM version =1.0.0-beta.52, =1.0.0-13, =0.0.3, =0.0.31, =0.1.0, =0.115.0, =0.115.0, =0.115.0, =0.46.0, =0.46.0, =0.115.0, =0.115.0, =0.50.0, =0.115.0, =0.123.2 and more Source cves: CVE-2025-57329 Source advisory: OSV:GHSA-2J4C-9QQQ-896R...

CVE-2025-57329

web3-core-method is a package designed to creates the methods on the web3 modules. A Prototype Pollution vulnerability in the attachToObject function of web3-core-method version 1.10.4 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing...

CVE-2025-57329

web3-core-method is a package designed to creates the methods on the web3 modules. A Prototype Pollution vulnerability in the attachToObject function of web3-core-method version 1.10.4 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing...

CVE-2025-59433

Conventional Changelog generates changelogs and release notes from a project's commit messages and metadata. Prior to version 2.0.0, @conventional-changelog/git-client has an argument injection vulnerability. This vulnerability manifests with the library's getTags API, which allows extra paramete...

cups: Authentication Bypass in CUPS Authorization Handling

A flaw was found in CUPS, a widely used printing service on Linux and UNIX-like systems. The issue arises when authentication is configured to use a method other than Basic, but the attacker sends an HTTP request with a Basic authentication header. Due to improper validation in the cupsdAuthorize...

cups: Authentication Bypass in CUPS Authorization Handling

A flaw was found in CUPS, a widely used printing service on Linux and UNIX-like systems. The issue arises when authentication is configured to use a method other than Basic, but the attacker sends an HTTP request with a Basic authentication header. Due to improper validation in the cupsdAuthorize...

CVE-2025-57329

web3-core-method is a package designed to creates the methods on the web3 modules. A Prototype Pollution vulnerability in the attachToObject function of web3-core-method version 1.10.4 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing...

CVE-2025-57329

web3-core-method is a package designed to creates the methods on the web3 modules. A Prototype Pollution vulnerability in the attachToObject function of web3-core-method version 1.10.4 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing...

CVE-2025-57329

The web3-core-method package (versions 1.10.4 and before ) is vulnerable to a Prototype Pollution vulnerability within the attachToObject function. By supplying a crafted payload, an attacker can inject arbitrary properties into Object.prototype , which are then inherited by all JavaScript object...

PT-2025-39328

Name of the Vulnerable Software and Affected Versions web3-core-method versions 1.10.4 and earlier Description A Prototype Pollution issue exists in the attachToObject function of web3-core-method. Attackers can inject properties onto Object.prototype by providing a crafted payload. This can lead...

CVE-2025-57354: Improperly Controlled Modification of Object Prototype Attributes

A vulnerability exists in the 'counterpart' library for Node.js and the browser due to insufficient sanitization of user-controlled input in translation key processing. The affected versions prior to 0.18.6 allow attackers to manipulate the library's translation functionality by supplying...

CVE-2025-57329: Improperly Controlled Modification of Object Prototype Attributes

web3-core-method is a package designed to creates the methods on the web3 modules. A Prototype Pollution vulnerability in the attachToObject function of web3-core-method version 1.10.4 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing...