7376 matches found
Malicious Package
Overview express-js-web is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
helm-ai (>=0.1.0, <=0.2.5), iflow-mcp-behinduall-wiki-js-mcp (1.0.0) +4 more potentially affected by unknown CVE via fastmcp (0.1.0)
fastmcp PYPI version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - helm-ai =0.1.0, =0.1.0, =0.1.1, =0.1.12 Source cves: unknown CVE Source advisory: OSV:GHSA-RCFX-77HG-W2WV...
@abcpros/minimal-slp-wallet (>=3.0.1, <=3.0.4), @abcpros/minimal-xpi-slp-wallet (>=3.0.4, <=3.0.10) +161 more potentially affected by CVE-2025-13158 via apidoc-core (>=0.2.2, <=0.15.0)
apidoc-core NPM version =0.2.2, =3.0.1, =3.0.4, =0.2.2, =1.4.3, =1.0.2, =3.0.10, =1.1.7, =1.0.1, =1.0.5, =0.6.9, =1.0.4, =1.0.10 - @comodinx/api-doc 1.0.0 and more Source cves: CVE-2025-13158 Source advisory: SNYK:JS-APIDOCCORE-14723211...
CVE-2025-14635
The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hapagecustomjs' parameter in all versions up to, and including, 3.20.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
PT-2025-54914
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=471075808 Crash type: Use-of-uninitialized-value Crash state: js create function JS EvalInternal JS EvalObject...
CVE-2025-68665
LangChain is a framework for building LLM-powered applications. Prior to @langchain/core versions 0.3.80 and 1.1.8, and prior to langchain versions 0.3.37 and 1.2.3, a serialization injection vulnerability exists in LangChain JS's toJSON method and subsequently when string-ifying objects using...
EUVD-2025-204863
Malicious code in @googlerecaptcha/js npm...
Security Bulletin: Multiple open source vulnerabilities affect IBM Db2 Big SQL on Cloud Pak for Data
Summary Multiple open source vulnerabilities affect IBM Db2 Big SQL 7 on Cloud Pak for Data 5 Vulnerability Details CVEID:CVE-2024-37891 DESCRIPTION: urllib3 could allow a remote authenticated attacker to obtain sensitive information, caused by the failure to strip the Proxy-Authorization header...
MAL-2025-192819 Malicious code in jz-user-js-bridge (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector edad349ed15deade0c4a98c62854a824c3319093fa858f5be069f8cc393a4617 The package jz-user-js-bridge was found to contain malicious code...
Malicious code in jz-native-js-bridge (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f5be9f16b75f7bf0ca5477443252a99142fcc146e923a7f77862df124ad6ac5 The package jz-native-js-bridge was found to contain malicious code...
MAL-2025-192817 Malicious code in jz-native-js-bridge (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f5be9f16b75f7bf0ca5477443252a99142fcc146e923a7f77862df124ad6ac5 The package jz-native-js-bridge was found to contain malicious code...
SUSE CVE-2025-64718
js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution proto. All users who parse untrusted yaml documents may be impacted. The problem is patched in...
Security Bulletin: Components with known vulnerabilities in IBM Security QRadar Analyst Workflow for IBM QRadar SIEM
Summary Multiple components with known vulnerabilities were addressed in a IBM Security QRadar Analyst Workflow for IBM QRadar SIEM release Vulnerability Details CVEID:CVE-2025-64756 DESCRIPTION: Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions...
EUVD-2025-204549
Malicious code in sonia3-npm-js npm...
Malicious code in sonia3-npm-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 339534853ebcb623a903a0515ab9ae854edaac8fdfec58d3edb454c501238d19 The package sonia3-npm-js was found to contain malicious code. Source: ghsa-malware 3b951ad6a6c46f78a032c0c93db496b6b13cfadccf178f195cd6c3f28531ed1e...
MAL-2025-192670 Malicious code in sonia3-npm-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 339534853ebcb623a903a0515ab9ae854edaac8fdfec58d3edb454c501238d19 The package sonia3-npm-js was found to contain malicious code. Source: ghsa-malware 3b951ad6a6c46f78a032c0c93db496b6b13cfadccf178f195cd6c3f28531ed1e...
Exploit for Deserialization of Untrusted Data in Facebook React
React2Shell: CVE-2025-55182 – Comprehensive Vulnerability Scan...
Next.js Framework React Server Components DoS (CVE-2025-55184)
The Next.js Framework on the remote host is affected by a denial of service vulnerability: - A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages:...
africa.shuwari.sbt:sbt-js_2.12_1.0 (>=0.14.1, <=0.16.1), africa.shuwari.sbt:sbt-netbeans_2.12_1.0 (>=0.1.0, <=0.1.1) +24488 more potentially affected by CVE-2025-68161 via org.apache.logging.log4j:log4j-core (>=2.0-beta9, <=2.25.2)
org.apache.logging.log4j:log4j-core MAVEN version =2.0-beta9, =0.14.1, =0.1.0, =0.9.6, =0.12.0, =0.9.6, =0.9.6, =0.9.6, =0.9.6, =0.14.1, =0.9.6, =0.14.1, =4.4.0.0, =1.4.6, =1.4.6, =1.4.9 and more Source cves: CVE-2025-68161 Source advisory: OSV:GHSA-VC5P-V9HR-52MJ...