Malicious code in @oldzeppelin/contract (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 59936093e10e486bceef6e021a4ca771a2996cf612a809e2bea28243348f8968 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3130 Malicious code in @oldzeppelin/contract (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 59936093e10e486bceef6e021a4ca771a2996cf612a809e2bea28243348f8968 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-2974

A vulnerability has been found in CodeCanyon Perfex CRM up to 3.2.1 and classified as problematic. This vulnerability affects unknown code of the file /contract of the component Contracts. The manipulation of the argument content leads to cross site scripting. The attack can be initiated remotely...

CVE-2025-2974 CodeCanyon Perfex CRM Contracts contract cross site scripting

A vulnerability has been found in CodeCanyon Perfex CRM up to 3.2.1 and classified as problematic. This vulnerability affects unknown code of the file /contract of the component Contracts. The manipulation of the argument content leads to cross site scripting. The attack can be initiated remotely...

PT-2025-13647

Name of the Vulnerable Software and Affected Versions CodeCanyon Perfex CRM versions up to 3.2.1 Description A vulnerability has been found in the Contracts component of CodeCanyon Perfex CRM, affecting unknown code of the file /contract. The manipulation of the content argument leads to cross-si...

MAL-2025-2813 Malicious code in @uniqa/contract-ms-spec-api (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-2812 Malicious code in @uniqa/contract-answers-ms-api (npm)

--- -= Per source details. Do not edit below this line.=-...

CosmWasm Allows Bypass of Capability Restrictions in Blockchains

An issue in CosmWasm prior to v2.2.0 allows attackers to bypass capability restrictions in blockchains by exploiting a lack of runtime capability validation. This allows attackers to deploy a contract without capability enforcement, and execute unauthorized actions on the blockchain...

[SECURITY] Fedora 42 Update: vyper-0.4.1-1.fc42

Pythonic Smart Contract Language for the EVM...

[SECURITY] Fedora 41 Update: vyper-0.4.1-1.fc41

Pythonic Smart Contract Language for the EVM...

Malicious code in depx-contract (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a69e0a710cd2cb5b4880fae8eb37ba76afea9f442c898ab7e528965336f75392 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2204 Malicious code in depx-contract (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a69e0a710cd2cb5b4880fae8eb37ba76afea9f442c898ab7e528965336f75392 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-0954

The WP Online Contract plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the jsonimport and jsonexport functions in all versions up to, and including, 5.1.4. This makes it possible for unauthenticated attackers to import and export the plugin's setting...

CVE-2025-0954 WP Online Contract <= 5.1.4 - Missing Authorization to Unauthenticated Settings Import

The WP Online Contract plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the jsonimport and jsonexport functions in all versions up to, and including, 5.1.4. This makes it possible for unauthenticated attackers to import and export the plugin's setting...

CVE-2025-0954 WP Online Contract <= 5.1.4 - Missing Authorization to Unauthenticated Settings Import

The WP Online Contract plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the jsonimport and jsonexport functions in all versions up to, and including, 5.1.4. This makes it possible for unauthenticated attackers to import and export the plugin's setting...

WordPress plugin WP Online Contract 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2025-0954: Missing Authorization

The WP Online Contract plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the jsonimport and jsonexport functions in all versions up to, and including, 5.1.4. This makes it possible for unauthenticated attackers to import and export the plugin's setting...

PT-2025-9818

Name of the Vulnerable Software and Affected Versions WP Online Contract plugin for WordPress versions up to, and including, 5.1.4 Description The issue allows unauthorized access due to a missing capability check on the json import and json export functions. This makes it possible for...

WordPress WP Online Contract plugin <= 5.1.4 - Missing Authorization to Unauthenticated Settings Import vulnerability

Missing Authorization to Unauthenticated Settings Import vulnerability discovered by Lucio Sá in WordPress Plugin WP Online Contract versions = 5.1.4...

CVE-2025-27104

vyper is a Pythonic Smart Contract Language for the EVM. Multiple evaluation of a single expression is possible in the iterator target of a for loop. While the iterator expression cannot produce multiple writes, it can consume side effects produced in the loop body e.g. read a storage variable...