WordPress Shortcodes and extra features for Phlox theme plugin <= 2.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aux_timeline' Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'auxtimeline' Shortcode vulnerability discovered by Ngô Thiên An ancorn in WordPress Plugin Shortcodes and extra features for Phlox theme versions = 2.15.7...

WordPress The Plus Addons for Elementor - Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

WordPress The Plus Addons for Elementor - Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin = 5.5.2 - Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Ngô Thiên An ancorn in WordPress Plugin The Plus Addons for Elementor Page Builder Lite...

Malicious Package

Overview apc-protobuf is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

PT-2026-2660

Name of the Vulnerable Software and Affected Versions Windows Kernel affected versions not specified Description A time-of-check time-of-use TOCTOU race condition exists within the Windows Kernel Memory. This condition can be exploited by an authorized attacker to gain elevated privileges on a...

CVE-2023-40752

There is a Cross Site Scripting XSS vulnerability in the "action" parameter of index.php in PHPJabbers Make an Offer Widget v1.0...

CVE-2021-33963

China Mobile An Lianbao WF-1 v1.0.1 router web interface through /api/ZRMacClone/macaddrclone receives parameters by POST request, and the parameter macType has a command injection vulnerability. An attacker can use the vulnerability to execute remote commands...

CVE-2021-33962

China Mobile An Lianbao WF-1 router v1.0.1 is affected by an OS command injection vulnerability in the web interface /api/ZRUsb/popusbdevice component...

CVE-2025-64121: Authentication Bypass Using an Alternate Path or Channel

Authentication Bypass Using an Alternate Path or Channel vulnerability in Nuvation Energy Multi-Stack Controller MSC allows Authentication Bypass.This issue affects Multi-Stack Controller MSC: from 2.3.8 before 2.5.1...

CVE-2019-25247: Cross-Site Request Forgery (CSRF)

Beward N100 H.264 VGA IP Camera M2.1.6 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without proper request validation. Attackers can craft a malicious web page with a hidden form to add an admin user by tricking a logged-in user into...

EUVD-2023-60103

In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Fix slab-out-of-bounds in sesenclosuredataprocess A fix for: BUG: KASAN: slab-out-of-bounds in sesenclosuredataprocess+0x949/0xe30 ses Read of size 1 at addr ffff88a1b043a451 by task systemd-udevd/3271 Checking after a...

EUVD-2025-141426

Malicious code in hunimi-satihu-an npm...

EUVD-2025-141437

Malicious code in hunimi-sathu-an npm...

EUVD-2025-147689

Malicious code in tobrut-hentai-an npm...

Malicious code in parwo-poke3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46036a44fc9ea14541a7e6ee28161307646cc6e3db41e92d2705ae20a4bf6d7e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-134479 Malicious code in iwan-lodeh27-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e2f30ca3f30b9c59ea499f7ea8b7aa8f73e0b0e3e41ea85b0e60cca9fb2f87d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-90946

Malicious code in iwan-sasag65-miaww npm...

CVE-2025-53409

An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We ha...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989005)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989005 advisory. In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't return unset power in ieee80211gettxpower We can get a UBSAN warning if...

Malicious Package

Overview internallibv799 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @imou/web-front-basic-alg is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...