CVE-2025-58407 GPU DDK - TOCTOU bug affecting psFWMemContext->uiPageCatBaseRegSet

Kernel or driver software installed on a Guest VM may post improper commands to the GPU Firmware to exploit a TOCTOU race condition and trigger a read and/or write of data outside the allotted memory escaping the virtual machine...

MAL-2025-190520 Malicious code in node-calculator-4e41 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13eeb23685dac84d542d197d77303c42cf1157c465348c204b391edca71c782d The package node-calculator-4e41 was found to contain malicious code. Source: ghsa-malware...

Malicious code in node-calculator-4e41 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13eeb23685dac84d542d197d77303c42cf1157c465348c204b391edca71c782d The package node-calculator-4e41 was found to contain malicious code. Source: ghsa-malware...

Malicious code in node-calculator-0f50 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37cd604b28cb577df0057a572f81e0fbda0029eb9017abcdea709811fefbc3d7 The package node-calculator-0f50 was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190516 Malicious code in node-calculator-0f50 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37cd604b28cb577df0057a572f81e0fbda0029eb9017abcdea709811fefbc3d7 The package node-calculator-0f50 was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190515 Malicious code in node-calculator-f4d5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 342de6f4f54c5a0a4df856c6dc87100b08337f11e82519b0cc2e99c90b26c9f0 The package node-calculator-f4d5 was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in node-calculator-6a88 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d3d08012b0edb7ff8014e7fd9d38b051af2d415bc1d506a474477a85d62eaf0 The package node-calculator-6a88 was found to contain malicious code. Source: ossf-package-analysis...

Command Injection

check-branches is vulnerable to command injection.The vulnerability is due to the tool trusting branch names as plain text and concatenating them into git commands, which allows an attacker to craft malicious branch names to execute arbitrary system commands...

CVE-2025-13284

ThinPLUS developed by ThinPLUS has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server...

CVE-2025-13284 ThinPLUS｜ThinPLUS - OS Command Injection

ThinPLUS developed by ThinPLUS has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server...

CVE-2025-13284 ThinPLUS｜ThinPLUS - OS Command Injection

ThinPLUS developed by ThinPLUS has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server...

The vulnerability of the Pandora FMS monitoring and management system, related to the lack of measures taken at the control level to clean data, allows a perpetrator to execute arbitrary commands and implant arbitrary OS commands.

The vulnerability of the Pandora FMS system for monitoring and managing IT environments stems from the lack of measures taken at the management level to secure data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands and inject arbitrary OS commands...

The vulnerability of the user interface of the Spectrum Power 4 software allows a perpetrator to execute arbitrary commands.

The vulnerability of the Spectrum Power 4 software’s user interface lies in the inclusion of functions from an unreliable and uncontrolled area. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2025-10460: Improper Input Validation

A SQL Injection vulnerability on an endpoint in BEIMS Contractor Web, a legacy product that is no longer maintained or patched by the vendor, allows an unauthorised user to retrieve sensitive database contents via unsanitized parameter input. This vulnerability occurs due to improper input...

CVE-2025-9501: Undefined Security Weakness

The W3 Total Cache WordPress plugin before 2.8.13 is vulnerable to command injection via the parsedynamicmfunc function, allowing unauthenticated users to execute PHP commands by submitting a comment with a malicious payload to a post...

MAL-2025-190500 Malicious code in com.mixpanel.unity (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a617ed7539b6703818676ef051a6c12331b0e014026d1b56fb7d72775d7ad5a1 The package com.mixpanel.unity was found to contain malicious code. Source: ossf-package-analysis...

MAL-2025-190499 Malicious code in filifecycleserv-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f108c68df2e2b35511f57d14d387ae5fe27a28b440bcbcd2e7b55bf30b8cd6f The package filifecycleserv-paypal was found to contain malicious code. Source: ghsa-malware...

Malicious code in filifecycleserv-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f108c68df2e2b35511f57d14d387ae5fe27a28b440bcbcd2e7b55bf30b8cd6f The package filifecycleserv-paypal was found to contain malicious code. Source: ghsa-malware...

CVE-2021-4470 TG8 Firewall Unauthenticated RCE via runphpcmd.php

TG8 Firewall contains a pre-authentication remote code execution vulnerability in the runphpcmd.php endpoint. The syscmd POST parameter is passed directly to a system command without validation and executed with root privileges. A remote, unauthenticated attacker can supply crafted values to...

CVE-2025-64446

CVE-2025-64446 is a high-severity relative path traversal in Fortinet FortiWeb that enables unauthenticated administrative command execution via crafted HTTP/HTTPS requests. Affected FortiWeb branches and patched versions are explicitly documented: 8.0.0–8.0.1 (fix in 8.0.2+), 7.6.0–7.6.4 (fix in...