CVE-2025-64420

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions prior to and including v4.0.0-beta.434, low privileged users are able to see the private key of the root user on the Coolify instance. This allows them to ssh to the server and...

CVE-2025-64420 Coolify members can see private key of root user

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions prior to and including v4.0.0-beta.434, low privileged users are able to see the private key of the root user on the Coolify instance. This allows them to ssh to the server and...

CVE-2025-64420 Coolify members can see private key of root user

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions prior to and including v4.0.0-beta.434, low privileged users are able to see the private key of the root user on the Coolify instance. This allows them to ssh to the server and...

Improper Cryptographic Key Management

Apache StreamPark is vulnerable to Improper Cryptographic Key Management. The vulnerability is due to using the user’s password directly as the HMAC signing key for JWTs, which allows an attacker to brute-force passwords offline or forge valid tokens to impersonate users and take over accounts...

CVE-2025-69257

CVE-2025-69257 (theshit) is a local privilege escalation vulnerability in the command-line tool that loads Python rules/configs from user-writable locations (e.g., ~/.config/theshit/) without validating ownership/permissions when executed with elevated privileges. If invoked with sudo or EUID=0, ...

CVE-2025-68897

Improper Control of Generation of Code 'Code Injection' vulnerability in Mohammad I. Okfie IF AS Shortcode if-as-shortcode allows Code Injection.This issue affects IF AS Shortcode: from n/a through = 1.2...

EUVD-2025-205596

Improper Control of Generation of Code 'Code Injection' vulnerability in Mohammad I. Okfie IF AS Shortcode allows Code Injection.This issue affects IF AS Shortcode: from n/a through 1.2...

CVE-2025-68897 WordPress IF AS Shortcode plugin <= 1.2 - Remote Code Execution (RCE) vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in Mohammad I. Okfie IF AS Shortcode if-as-shortcode allows Code Injection.This issue affects IF AS Shortcode: from n/a through = 1.2...

CVE-2025-68897

The connected Wordfence report documents CVE-2025-68897 as affecting IF AS Shortcode. It is described as an Unauthenticated? No, the entry shows “Authenticated (Contributor+) Remote Code Execution” via the IF AS Shortcode before 1.2, implying code execution when an attacker with Contributor+ righ...

CVE-2025-68897 WordPress IF AS Shortcode plugin <= 1.2 - Remote Code Execution (RCE) vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in Mohammad I. Okfie IF AS Shortcode if-as-shortcode allows Code Injection.This issue affects IF AS Shortcode: from n/a through = 1.2...

CVE-2025-68897: Improper Control of Generation of Code

Improper Control of Generation of Code 'Code Injection' vulnerability in Mohammad I. Okfie IF AS Shortcode if-as-shortcode allows Code Injection.This issue affects IF AS Shortcode: from n/a through = 1.2...

ChurchCRM Privilege Elevation Vulnerability

ChurchCRM is an open source CRM system for churches. ChurchCRM suffers from an elevation of privilege vulnerability that stems from the application not properly implementing an access control mechanism that directly references data transmitted from the client as an object, no details of the...

Malicious code in chai-as-validated (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac732b7c822ce779d3d7579dba60aef4d3d11aadbd5ee31db0eab0e240833634 The package chai-as-validated was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-204929

Malicious code in chai-as-validated npm...

MAL-2025-192724 Malicious code in chai-as-validated (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac732b7c822ce779d3d7579dba60aef4d3d11aadbd5ee31db0eab0e240833634 The package chai-as-validated was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-204930

Malicious code in chai-as-tested npm...

MAL-2025-192723 Malicious code in chai-as-tested (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfbc69e8b6f340614b2fdd5378d7f730a4d79e03499a7e41b578028ad970e4eb The package chai-as-tested was found to contain malicious code...

Malicious code in chai-as-tested (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfbc69e8b6f340614b2fdd5378d7f730a4d79e03499a7e41b578028ad970e4eb The package chai-as-tested was found to contain malicious code...

MAL-2025-192722 Malicious code in chai-as-deploy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6777d6fb72a2a1e304855ebdd4aa8f8e5e8410136ebcc580b71b5e5f4152eaf2 The package chai-as-deploy was found to contain malicious code...

Malicious code in chai-as-deploy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6777d6fb72a2a1e304855ebdd4aa8f8e5e8410136ebcc580b71b5e5f4152eaf2 The package chai-as-deploy was found to contain malicious code...