MAL-2025-48453 Malicious code in src_pages_list_index_tsx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 191404621c42806b5e14f38b5dd6674109c26eb03902fa54c23312ee369c6d72 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in helosifjowe2342 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6ff27da2ff03d6b016cef58dfffd401cb2f19e84cf787613903f36a4b834a7c3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48451 Malicious code in helosifjowe2342 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6ff27da2ff03d6b016cef58dfffd401cb2f19e84cf787613903f36a4b834a7c3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cp2-shared-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e522530df817242e07e68b2cb283eb4e70763b4ba8d248c97791fab28dc67887 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48450 Malicious code in cp2-shared-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e522530df817242e07e68b2cb283eb4e70763b4ba8d248c97791fab28dc67887 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Command Injection

Hoverfly is vulnerable to Command Injection. The vulnerability is due to improper input validation in the middleware endpoint due to the binary and script parameters being passed directly into a system without sanitization. This allows an attacker to supply crafted values for those parameters to...

Security update for chrony

This update for chrony fixes the following issues: Update to version 4.8: Add maxunreach option to limit selection of unreachable sources Add -u option to chronyc to drop root privileges default chronyc user is set by configure script Fix refclock extpps option to work on Linux = 6.15 Validate...

EUVD-2025-34858

The iSherlock developed by HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server...

PT-2025-42668

Name of the Vulnerable Software and Affected Versions MediaWiki Cargo extension versions 1.39, 1.43, and 1.44 Description A flaw exists in the MediaWiki Cargo extension that allows for SQL Injection. This occurs due to improper neutralization of special elements within SQL commands. The issue cou...

PT-2025-42650

Name of the Vulnerable Software and Affected Versions Apache Geode versions 1.10 through 1.15.1 Description Apache Geode is susceptible to Cross-Site Request Forgery CSRF attacks via GET requests to the Management and Monitoring REST API. Successful exploitation could allow an attacker to execute...

PT-2025-42596

Name of the Vulnerable Software and Affected Versions Hikvision iSecure Center affected versions not specified Description The software contains insufficient parameter validation, leading to a command injection issue. Attackers may be able to gain platform privileges and execute arbitrary command...

F5 BIG-IP Elevation of Privilege Vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, and remote access policy management. An elevation of privilege vulnerability exists in the BIG-IP's iControl REST and TMOS Shell tmsh modules. The vulnerability...

CVE-2023-28815: Improper Neutralization of Parameter/Argument Delimiters

Some versions of Hikvision's iSecure Center Product contain insufficient parameter validation, resulting in a command injection vulnerability. Attackers may exploit this to gain platform privileges and execute arbitrary commands on the system.iSecure Center is software released for China's domest...

CVE-2025-62422: Improper Neutralization of Special Elements used in an SQL Command

DataEase is an open source data visualization and analytics platform. In versions 2.10.13 and earlier, the /de2api/datasetData/tableField interface is vulnerable to SQL injection. An attacker can construct a malicious tableName parameter to execute arbitrary SQL commands. This issue is fixed in...

CVE-2025-34514

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain authenticated OS command injection vulnerabilities in multiple web-accessible PHP scripts that call exec and allow an authenticated attacker to execute arbitrary commands. Ilevia has declined to service this vulnerability, and...

CVE-2025-62378

CommandKit is the discord.js meta-framework for building Discord bots. In versions 1.2.0-rc.1 through 1.2.0-rc.11, a logic flaw exists in the message command handler that affects how the commandName property is exposed to both middleware functions and command execution contexts when handling...

CVE-2025-53868

When running in Appliance mode, a highly privileged authenticated attacker with access to SCP and SFTP may be able to bypass Appliance mode restrictions using undisclosed commands. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

BIT-VALKEY-2025-32023 Redis allows out of bounds writes in hyperloglog commands leading to RCE

Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog operations, potentially leading to remote code execution. The...

BIT-REDIS-2025-32023 Redis allows out of bounds writes in hyperloglog commands leading to RCE

Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog operations, potentially leading to remote code execution. The...

Malicious code in hyperion-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b9ccc060b3a05f5422ec317fc83c828522f43b1b0b2ce916d1c5d72bf082366 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...