Malicious code in post-purchase-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f7c59be0aca6f22fc3b7ea58767ce53286e50138bbb75674cc2a7cdce3d1ad4 The package post-purchase-frontend was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

MAL-2025-49731 Malicious code in post-purchase-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f7c59be0aca6f22fc3b7ea58767ce53286e50138bbb75674cc2a7cdce3d1ad4 The package post-purchase-frontend was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

CVE-2025-23050

QLowEnergyController in Qt before 6.8.2 mishandles malformed Bluetooth ATT commands, leading to an out-of-bounds read or division by zero. This is fixed in 5.15.19, 6.5.9, and 6.8.2. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Re...

Dell CloudLink Command Execution Vulnerability (CNVD-2025-28522)

Dell CloudLink is a data encryption and key management system from Dell USA. A command execution vulnerability exists in Dell CloudLink, which could be exploited by an attacker to execute arbitrary commands on the system...

CVE-2025-12155: Improper Neutralization of Special Elements used in a Command

A Command Injection vulnerability, resulting from improper file path sanitization Directory Traversal in Looker allows an attacker with Developer permission to execute arbitrary shell commands when a user is deleted on the host system. Looker-hosted and Self-hosted were found to be vulnerable. Th...

OS Command Injection

@react-native-community/cli is vulnerable to OS Command Injection. The vulnerability is due to an exposed endpoint that accepts attacker-controlled POST data and passes it to system execution paths without proper sanitization, which allows an unauthenticated network attacker to run arbitrary...

MAL-2025-49453 Malicious code in karemv1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9be53d7d069f1115ab0b8be4e3243af9ffb512d8a6dc0e31b5395852b1cbc3cd The package karemv1 was found to contain malicious code. Source: ghsa-malware 3f4cd13aca826d2f26c0f7927f298a62ee3f5a66fcc8567eff78027b93a02144 Any...

Malicious code in karemv1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9be53d7d069f1115ab0b8be4e3243af9ffb512d8a6dc0e31b5395852b1cbc3cd The package karemv1 was found to contain malicious code. Source: ghsa-malware 3f4cd13aca826d2f26c0f7927f298a62ee3f5a66fcc8567eff78027b93a02144 Any...

CVE-2025-64140

Jenkins Azure CLI Plugin 0.9 and earlier does not restrict which commands it executes on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary shell commands...

Malicious code in payments-notifications (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec2ff3c7a16e539813080b53ccec2b3531078fed7382156c676025c1188b9c7c The package payments-notifications was found to contain malicious code. Source: ossf-package-analysis...

MAL-2025-49390 Malicious code in payments-notifications (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec2ff3c7a16e539813080b53ccec2b3531078fed7382156c676025c1188b9c7c The package payments-notifications was found to contain malicious code. Source: ossf-package-analysis...

CVE-2025-63718

A SQL injection vulnerability exists in the SourceCodester PQMS Patient Queue Management System 1.0 in the apipatientschedule.php endpoint. The appointmentID parameter is not properly sanitized, allowing attackers to execute arbitrary SQL commands...

CVE-2025-63601

Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenticated attacker to upload a malicious backup file containing arbitrary files and execute system commands...

CVE-2025-64114

ClipBucket v5 is an open source video sharing platform. Versions 5.5.2 - 151 and below allow authenticated administrators with plugin management privileges to execute arbitrary SQL commands against the database through its ClipBucket Custom Fields plugin. The vulnerabilities require the Custom...

NEC EXPRESSCLUSTER X和NEC EXPRESSCLUSTER X SingleServerSafe 安全漏洞

NEC EXPRESSCLUSTER X and NEC EXPRESSCLUSTER X SingleServerSafe are both disaster recovery software from Nippon Electric NEC. A security vulnerability exists in NEC EXPRESSCLUSTER X and NEC EXPRESSCLUSTER X SingleServerSafe that originates from an attacker's ability to send specially crafted netwo...

Apollo Router Core 访问控制错误漏洞

Apollo Router Core is a router core application for the Apollo community. An access control error vulnerability exists in Apollo Router Core versions 1.61.12-rc.0 and earlier and 2.8.1-rc.0, which stems from not enforcing renamed access control commands, which could lead to bypassing element-leve...

CVE-2025-63718: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability exists in the SourceCodester PQMS Patient Queue Management System 1.0 in the apipatientschedule.php endpoint. The appointmentID parameter is not properly sanitized, allowing attackers to execute arbitrary SQL commands...

Malicious code in revenuecat-mcp-extension (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96f411f3e2786cc80d5d85bf7feb0c72705b6e5c95af9c002b0f716e0b15ea83 The package revenuecat-mcp-extension was found to contain malicious code. Source: ossf-package-analysis...

MAL-2025-49378 Malicious code in revenuecat-mcp-extension (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96f411f3e2786cc80d5d85bf7feb0c72705b6e5c95af9c002b0f716e0b15ea83 The package revenuecat-mcp-extension was found to contain malicious code. Source: ossf-package-analysis...

Command Injection

adb-mcp Server is vulnerable to Command Injection. The vulnerability is due to improper handling of user-supplied input in certain MCP Server tool definitions and implementations, which allows an attacker to inject and execute arbitrary system commands...