@4via6/relay (>=1.0.0, <=1.1.3), @circleci/agents (>=1.0.6, <=2.3.1) +4 more potentially affected by CVE-2025-54558 via @openai/codex (>=0.1.2504211509, <=0.8.0)

@openai/codex NPM version =0.1.2504211509, =1.0.0, =1.0.6, =0.23.0, =1.0.0, =0.0.1, =1.0.0, =1.0.2 Source cves: CVE-2025-54558 Source advisory: MEND:CVE-2025-54558...

Malicious code in codex-action (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3768693d4c833924ee984473a49391e5c0e5778d627f2f7e16f1b565ac38104a The OpenSSF Package Analysis project identified 'codex-action' @ 99.3...

MAL-2025-6082 Malicious code in codex-action (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3768693d4c833924ee984473a49391e5c0e5778d627f2f7e16f1b565ac38104a The OpenSSF Package Analysis project identified 'codex-action' @ 99.3...

Malware in codex-cipher

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2021-43635

A Cross Site Scripting XSS vulnerability exists in Codex before 1.4.0 via Notebook/Page name field, which allows malicious users to execute arbitrary code via a crafted http code in a .json file...

Malicious code in codex-cipher (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ce020b1fc0f9d126255429ca44d4407527446d2650c546670d79bc9c84056cb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2624 Malicious code in codex-cipher (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ce020b1fc0f9d126255429ca44d4407527446d2650c546670d79bc9c84056cb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-24365

creationtimestamp| type| source ---|---|--- 2025-01-27 17:54:07+00:00| seen| https://infosec.exchange/users/cve/statuses/113901597263624137 2025-01-27 18:16:25+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lgqkdjn3ep2f 2025-01-27 20:11:24+00:00| seen|...

CVE-2025-24364

creationtimestamp| type| source ---|---|--- 2025-01-27 17:48:22+00:00| seen| https://infosec.exchange/users/cve/statuses/113901574697474273 2025-01-27 18:16:21+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lgqkdgggem2w 2025-01-27 20:11:24+00:00| seen|...

PT-2026-2478

Name of the Vulnerable Software and Affected Versions Node.js versions 8.x through 18.x Node.js versions 20.x through 20.20.0 Node.js versions 22.x through 22.22.0 Node.js versions 24.x through 24.13.0 Node.js versions 25.x through 25.3.0 Description A critical issue exists in Node.js related to...

PT-2025-42561

Name of the Vulnerable Software and Affected Versions mediawiki affected versions not specified Description The software contains a flaw related to the escaping of the submit button label for Codex-based HTML forms. This could potentially lead to issues with how the submit button is displayed or...

agwui (>=0.0.3, <=0.0.6), awehflow (1.10.6.1) +53 more potentially affected by CVE-2024-49766 via werkzeug (0.16.0)

werkzeug PYPI version 0.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - agwui =0.0.3, =0.2.1, =0.3.4, =2.1.0, =0.0.2, =0.4.0, =0.2.0, =0.0.1, =0.7.0, =0.16.1, =0.16.3 and more Source cves: CVE-2024-49766 Source...

camminapy (>=1.0.0, <=1.1.6), cb2game (>=0.9.4, <=1.0.3) +2 more potentially affected by CVE-2024-38526 via pdoc (13.1.1)

pdoc PYPI version 13.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pdoc and may be impacted: - camminapy =1.0.0, =0.9.4, =0.4.5, =0.3.0, =0.6.0 Source cves: CVE-2024-38526 Source advisory: OSV:GHSA-5VGJ-GGM4-FG62...

agwui (>=0.0.3, <=0.0.6), awehflow (1.10.6.1) +53 more potentially affected by CVE-2024-34069 via werkzeug (0.16.0)

werkzeug PYPI version 0.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - agwui =0.0.3, =0.2.1, =0.3.4, =2.1.0, =0.0.2, =0.4.0, =0.2.0, =0.0.1, =0.7.0, =0.16.1, =0.16.3 and more Source cves: CVE-2024-34069 Source...

CVE-2023-45639

Cross-Site Request Forgery CSRF vulnerability in Codex-m Sort SearchResult By Title plugin = 10.0 versions...

CVE-2023-45639

Cross-Site Request Forgery CSRF vulnerability in Codex-m Sort SearchResult By Title plugin = 10.0 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Codex-m Sort SearchResult By Title plugin = 10.0 versions...

CVE-2023-45639 WordPress Sort SearchResult By Title Plugin <= 10.0 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Codex-m Sort SearchResult By Title plugin = 10.0 versions...

CVE-2023-45639

CVE-2023-45639 concerns the WordPress plugin Sort SearchResult By Title (Codex-m) with versions

CVE-2023-45639 WordPress Sort SearchResult By Title Plugin <= 10.0 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Codex-m Sort SearchResult By Title plugin = 10.0 versions...