MAL-2025-192355 Malicious code in fdir4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64821a4790ad9d467b84b11aa1c7038cfa1d2c7307e7db03f049a76104c15850 The package fdir4 was found to contain malicious code. Source: ossf-package-analysis 2864053a37838b568ec7f045df7742f31a81c95af5bf06a5684c8b1361a213b7...

Malicious code in fdir2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19307a303580d9399ea5d4c9bee17c0e89d9f81daaab855f99563080ba79630c The package fdir2 was found to contain malicious code. Source: ossf-package-analysis 8999cc376e31073e8a5937b4bed10d25255c312d9b6c888bfad3a30401583b77...

MAL-2025-192354 Malicious code in fdir2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19307a303580d9399ea5d4c9bee17c0e89d9f81daaab855f99563080ba79630c The package fdir2 was found to contain malicious code. Source: ossf-package-analysis 8999cc376e31073e8a5937b4bed10d25255c312d9b6c888bfad3a30401583b77...

MAL-2025-192360 Malicious code in ssf-desktop-api-openfin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 367b2689b7d50c48e26747ef1edce3a36165d64fd361ad3fc19f1c52fce204f9 The package ssf-desktop-api-openfin was found to contain malicious code. Source: ossf-package-analysis...

CVE-2025-66237

DCIM dcTrack platforms utilize default and hard-coded credentials for access. An attacker could use these credentials to administer the database, escalate privileges on the platform or execute system commands on the host...

CVE-2025-66562

TUUI is a desktop MCP client designed as a tool unitary utility integration. Prior to 1.3.4, a critical Remote Code Execution RCE vulnerability exists in Tuui due to an unsafe Cross-Site Scripting XSS flaw in the Markdown rendering component. Tuui allows the execution of arbitrary JavaScript with...

EUVD-2025-201459

TUUI is a desktop MCP client designed as a tool unitary utility integration. Prior to 1.3.4, a critical Remote Code Execution RCE vulnerability exists in Tuui due to an unsafe Cross-Site Scripting XSS flaw in the Markdown rendering component. Tuui allows the execution of arbitrary JavaScript with...

CVE-2025-64052

An issue was discovered in Fanvil x210 V2 2.12.20 allowing unauthenticated attackers on the local network to execute arbitrary system commands...

Exploit for CVE-2025-55182

Research: All versions of CVE-2025-55182 exploit vulnerabiliti...

CVE-2025-58098

The Apache HTTP Server (versions 2.4.65 and earlier ) is vulnerable to a security flaw when Server Side Includes (SSI) is enabled and mod_cgid (but not mod_cgi) is active. The root cause is that the server passes the shell-escaped query string as extra arguments to the #exec cmd="..." directives....

CVE-2025-64052

The Fanvil x210 V2 IP telephony device, specifically version 2.12.20 , is vulnerable to an issue that allows unauthenticated attackers on the local network to execute arbitrary system commands . This vulnerability is characterized by the improper neutralization of special elements used in a comma...

CVE-2025-13426: Improper Control of Dynamically-Managed Code Resources

A vulnerability exists in Google Apigee's JavaCallout policy https://docs.apigee.com/api-platform/reference/policies/java-callout-policy that allows for remote code execution. It is possible for a user to write a JavaCallout that injected a malicious object into the MessageContext to execute...

CVE-2025-64052

An issue was discovered in Fanvil x210 V2 2.12.20 allowing unauthenticated attackers on the local network to execute arbitrary system commands...

CVE-2025-64054

The Fanvil x210 IP telephony device, specifically version 2.12.20 , is susceptible to a reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this by sending a crafted POST request to the /cgi-bin/webconfig?page=upload&action=submit endpoint. Successful exploitation could le...

PT-2025-49254

A reflected Cross Site Scripting XSS vulnerability on Fanvil x210 2.12.20 devices allows attackers to cause a denial of service or potentially execute arbitrary commands via crafted POST request to the /cgi-bin/webconfig?page=upload&action=submit endpoint...

CVE-2025-64052

An issue was discovered in Fanvil x210 V2 2.12.20 allowing unauthenticated attackers on the local network to execute arbitrary system commands...

CVE-2025-12026

An Out-of-bounds Write vulnerability in WatchGuard Fireware OS’s certificate request command could allow an authenticated privileged user to execute arbitrary code via specially crafted CLI commands...

EUVD-2025-201267

Easywall 0.3.1 allows authenticated remote command execution via a command injection vulnerability in the /ports-save endpoint that suffers from a parameter injection flaw. Attackers can inject shell metacharacters to execute arbitrary commands on the server...

CVE-2025-55948

This vulnerability fundamentally arises from yzcheng90 X-SpringBoot 6.0's implementation of role-based access control RBAC through dual dependency on frontend menu systems and backend permission tables, without enforcing atomic synchronization between these components. The critical flaw manifests...

CVE-2025-55948

This vulnerability fundamentally arises from yzcheng90 X-SpringBoot 6.0's implementation of role-based access control RBAC through dual dependency on frontend menu systems and backend permission tables, without enforcing atomic synchronization between these components. The critical flaw manifests...