1000 Projects ABC Courier Management System Security Breach

1000 Projects ABC Courier Management System is an open source courier management system from 1000 Projects. 1000 Projects ABC Courier Management System version 1.0 has a security vulnerability , the vulnerability stems from the wrong operation of the parameter Username in the file / adminSQL ,...

MAL-2025-4697 Malicious code in dc-spectrum-v3-core (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8f90b2269a7759d64a1656b51e7f35e99c4005a61cd9012d931d6965bd544aa1 Any computer that has this package installed or running should be considered...

CVE-2025-1793

A flaw was found in llama-index. SQL injection vulnerabilities exist within multiple vector store integrations in version v0.12.21, allowing an attacker to execute arbitrary SQL queries. This issue enables unauthorized reading and writing of data via crafted SQL commands. Successful exploitation...

CVE-2025-49008

Atheos is a self-hosted browser-based cloud integrated development environment. Prior to version 6.0.4, improper use of escapeshellcmd in /components/codegit/traits/execute.php allows argument injection, leading to arbitrary command execution. Atheos administrators and users of vulnerable version...

PT-2025-23876 · Atheros · Atheos

Name of the Vulnerable Software and Affected Versions: Atheos versions prior to 6.0.4 Description: Atheos is a self-hosted browser-based cloud integrated development environment. The improper use of escapeshellcmd in /components/codegit/traits/execute.php allows argument injection, leading to...

1000 Projects Online Notice Board 安全漏洞

1000 Projects Online Notice Board is an online bulletin board from 1000 Projects open source. A security vulnerability exists in 1000 Projects Online Notice Board version 1.0, which stems from an incorrect manipulation of the parameter fname, resulting in SQL injection...

Incentivizing Collaborative Breach Detection

Decoy passwords, or "honeywords," alert a site to its breach if they are ever entered in a login attempt on that site. However, an attacker can identify a user-chosen password from among the decoys, without risk of alerting the site to its breach, by performing credential stuffing, i.e., entering...

CVE-2025-5690

The CVE-2025-5690 entry concerns PostgreSQL Anonymizer (versions 2.0 and 2.1). Affected component: the masking mechanism when dynamic masking is enabled, which allows a masked user to bypass table masking rules and read original data via a database cursor or the --insert option in pg_dump. This i...

Exclusive: Hackers Leak 86 Million AT&T Records with Decrypted SSNs

Hackers leak data of 88 million AT&T customers with decrypted SSNs; latest breach raises questions about links to earlier Snowflake-related attack...

MAL-2025-4673 Malicious code in @sasmeee/gamble (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c87f47f35d7c73fd035a897353adf49aa127f906c05e5bb8ffa791b9465d8f71 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-23864 · Unknown +1 · Postgresql Anonymizer +1

Name of the Vulnerable Software and Affected Versions: PostgreSQL Anonymizer versions 2.0 through 2.1 Description: The issue allows a masked user to bypass the masking rules defined on a table and read the original data using a database cursor or the --insert option of pg dump. This problem occur...

Deno 安全漏洞

Deno is a simple, modern and secure JavaScript and TypeScript runtime environment from Deno Open Source. A security vulnerability exists in Deno versions prior to 2.1.13 and prior to 2.2.13, which stems from an omission of the deny-env option in the Deno.env.toObject method, which could lead to t...

Google Pixel Security Breach

Google Pixel is a smartphone from the American company Google Google. Google Pixel has a security vulnerability that originates in the modem and could lead to elevated privileges...

Google Pixel Security Breach

Google Pixel is a smartphone from the American company Google Google. Google Pixel has a security vulnerability which originates from Exynos RIL and could lead to information leakage...

shiyi-blog 安全漏洞

shiyi-blog is a vue+springboot front-end and back-end separated blog system by bule individual developer. A security vulnerability exists in shiyi-blog 1.2.1 and earlier versions, which stems from an improper authorization issue...

Google Pixel Security Breach

Google Pixel is a smartphone from the American company Google Google. Google Pixel suffers from a security vulnerability that originates in the Bluetooth Bluetooth component of the device and could lead to elevation of privileges...

Google Pixel Security Breach

Google Pixel is a smartphone from the American company Google Google. Google Pixel has a security vulnerability that originates in the component TPU and could lead to elevated privileges...

CVE-2025-5036 RFA File Parsing Use-After-Free Vulnerability

A maliciously crafted RFA file, when linked or imported into Autodesk Revit, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process...

MAL-2025-4662 Malicious code in vue-black-dashboard (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d77bae724170beee5b8b27e6eeaa6aaed66e932eed0a0d012b42ab862475d428 Any computer that has this package installed or running should be considered...

Gokapi 安全漏洞

Gokapi is a lightweight self-hosted Firefox sending alternative by Marc Bulling, a personal developer. A security vulnerability exists in Gokapi versions prior to 2.0.0, which stems from the fact that embedded JavaScript code in uploaded filenames may lead to a stored cross-site scripting attack...