MAL-2025-4410 Malicious code in tgi-fe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2dfb398d22e1b55329c8470ec5d984d35d24a20ca084875de34497095c3f4800 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-43766

Apache IoTDB version 0.12.2 to 0.12.6, 0.13.0 to 0.13.2 are vulnerable to a Denial of Service attack when accepting untrusted patterns for REGEXP queries with Java 8. Users should upgrade to 0.13.3 which addresses this issue or use a later version of Java to avoid it...

PT-2025-22780 · Woocommerce · Storekeeper For Woocommerce

Name of the Vulnerable Software and Affected Versions: StoreKeeper for WooCommerce versions through 14.4.4 Description: The issue allows for the unrestricted upload of files with dangerous types, enabling an attacker to upload a web shell to a web server. This can lead to further exploitation and...

Atlassian Confluence 2.2.x < 8.5.21 / 8.6.x < 9.2.2 / 9.3.x < 9.3.2 (CONFSERVER-99568)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-99568 advisory. - XStream is a simple library to serialize objects to XML and back again. This vulnerability may allow a remote attacker to terminate the applicatio...

CVE-2022-39202

matrix-appservice-irc is an open source Node.js IRC bridge for Matrix. The Internet Relay Chat IRC protocol allows you to specify multiple modes in a single mode command. Due to a bug in the underlying matrix-org/node-irc library, affected versions of matrix-appservice-irc perform parsing of such...

WordPress Goodlayers Hostel plugin <= 3.1.4 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Bonds in WordPress Plugin Goodlayers Hostel versions = 3.1.4...

PT-2025-22402

Name of the Vulnerable Software and Affected Versions Vasco versions 3.14 and earlier Description The issue allows a remote attacker to obtain sensitive information via the help menu. This is due to a Local File Inclusion vulnerability. Recommendations For versions 3.14 and earlier, consider...

Recommender Systems for Democracy: toward Adversarial Robustness in Voting Advice Applications

Voting advice applications VAAs help millions of voters understand which political parties or candidates best align with their views. This paper explores the potential risks these applications pose to the democratic process when targeted by adversarial entities. In particular, we expose 11...

WordPress WP DeskLite plugin <= 1.0.0 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Hassan Khan Yusufzai - Splint3r7 in WordPress Plugin WP DeskLite versions = 1.0.0...

Security Bulletin: Vulnerability in path-to-regexp affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in path-to-regexp has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information...

PT-2025-21512 · WordPress · Javascript Logic

Name of the Vulnerable Software and Affected Versions: JavaScript Logic WordPress plugin versions 0.1 and earlier Description: The issue concerns a lack of CSRF check in some areas of the plugin, along with missing sanitization and escaping. This could allow attackers to make logged-in admins add...

CVE-2025-32421 Next.js Race Condition to Cache Poisoning

Next.js is a React framework for building full-stack web applications. Versions prior to 14.2.24 and 15.1.6 have a race-condition vulnerability. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve pageProps data instead of standard HTML. Thi...

GHSA-W9HF-35Q4-VCJW nosurf vulnerable to CSRF due to non-functional same-origin request checks

Impact This vulnerability allows an attacker who controls content on the target site, or on a subdomain of the target site either via XSS, or otherwise to bypass Cross-Site Request Forgery checks and issue requests on user's behalf. Details Due to misuse of the Go net/http library, nosurf...

GLSA-202505-05 : Orc: Arbitrary Code Execution

The remote host is affected by the vulnerability described in GLSA-202505-05 Orc: Arbitrary Code Execution Please review the CVE identifier referenced below for details. Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory. Note that Nessus has no...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.15.50 bug fix and security update

Red Hat OpenShift Container Platform release 4.15.50 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.15. Red Hat Product Security has rated this update as having a...

PT-2025-20165 · Yaysmtp · Yaysmtp

Name of the Vulnerable Software and Affected Versions: YaySMTP versions n/a through 2.6.4 Description: The issue is related to an Improper Neutralization of Special Elements used in an SQL Command, also known as SQL Injection. This allows for Blind SQL Injection, which can be exploited...

Google Chrome < 136.0.7103.92 Vulnerability

The version of Google Chrome installed on the remote macOS host is prior to 136.0.7103.92. It is, therefore, affected by a vulnerability as referenced in the 202505stable-channel-update-for-desktop advisory. - Use after free in WebAudio in Google Chrome prior to 136.0.7103.92 allowed a remote...

CVE-2025-46734

CVE-2025-46734 affects the PHP Markdown parser league/commonmark, specifically the Attributes extension (versions 1.5.0–2.6.x). The vulnerability allows injection of dangerous HTML attributes via Markdown syntax (e.g., curly braces) that can bypass HTML sanitization settings. Version 2.7.0 mitiga...

PT-2025-18585 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.11 Description: A vulnerability has been resolved in the Linux kernel. The issue is related to the phy: ralink: mt7621-pci driver, where a sentinel was added to the quirks table. With the correction of the...

PT-2025-18202 · Unknown · Pcman Ftp Server

Name of the Vulnerable Software and Affected Versions: PCMan FTP Server versions 2.0.0 through 2.0.7 Description: A critical vulnerability was found in the RENAME Command Handler component of PCMan FTP Server, leading to a buffer overflow. This issue can be exploited remotely. The vulnerability i...