MAL-2025-19030 Malicious code in dynamic-form-components (npm)

The package dynamic-form-components was found to contain malicious code...

CVE-2023-5342

The Fedora Secure Boot CA certificate shipped with shim in Fedora was expired which could lead to old or invalid signed boot components being loaded...

CVE-2023-5342

The Fedora Secure Boot CA certificate shipped with shim in Fedora was expired which could lead to old or invalid signed boot components being loaded...

Arbitrary Code Injection

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Arbitrary Code Injection due to the unsafe implementation of a dynamic Function constructor. An attacker can execute arbitrary JavaScript code on the server by sending a crafted POST request...

Command Injection

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Command Injection via the CustomMCP class. An attacker can gain unauthorized remote access and execute arbitrary operating system commands by sending crafted requests over the network. This i...

PT-2025-33478 · Fedora · Shim

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. affected versions not specified Description: The Fedora Secure Boot CA certificate shipped with shim in Fedora was expired, potentially allowing the loading of old or invalid signed boot components...

Security Bulletin: Multiple vulnerabilities in IBM Controller

Summary There are vulnerabilities in Open-Source Software OSS components used by IBM Controller. This Security Bulletin relates only to the direct usage of third-party components by IBM Controller and not any nested dependencies within the product. Vulnerability Details CVEID:CVE-2015-6420...

PT-2025-32984

Name of the Vulnerable Software and Affected Versions AMPHP affected versions not specified Apache Tomcat affected versions not specified Eclipse Foundation affected versions not specified F5 affected versions not specified Fastly affected versions not specified gRPC affected versions not specifi...

ROS-20250812-04

Vulnerability of decodeComponents function of decode-uri-component URI decoder is related to insufficient input data validation. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service. remotely to cause a denial of service...

Siemens Third-Party Components in SINEC OS

SUMMARY SINEC OS before V3.2 contains third-party components with multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions. 2. GENERAL RECOMMENDATIONS As a general security measure, Siemens strongly recommends to...

Siemens SINEC OS

SUMMARY SINEC OS before V3.1 contains third-party components with multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions. 2. GENERAL RECOMMENDATIONS As a general security measure, Siemens strongly recommends to...

BIT-LIBPHP-2020-7071 FILTER_VALIDATE_URL accepts URLs with invalid userinfo

In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8.0.0, when validating URL with functions like filtervar$url, FILTERVALIDATEURL, PHP will accept an URL with invalid password as valid URL. This may lead to functions that rely on URL being valid to mis-parse the URL and produce wrong dat...

Security Bulletin: Astronomer with IBM is vulnerable to several vulnerabilities

Summary Open source software is used by Astronomer with IBM as part of overall processing functionality. Vulnerability Details CVEID:CVE-2008-1530 DESCRIPTION: GnuPG gpg 1.4.8 and 2.0.8 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via crafted...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector, victoriametrics-operator, cargobump, crossplane-provider-sql, k8sgateway, rancher-system-agent, dex, kbld, nri-memcached, sqlexporter, crossplane-provider-family-azure, falco-exporter, kine, pulumi-language-java, nvidia-container-toolkit,...

CVE-2025-47907 vulnerabilities

Vulnerabilities for packages: hydra, kubecolor, flux, crossplane-provider-azure-authorization, flux-source-controller-fips, k3d, nri-postgresql, mattermost-fips, prometheus-postgres-exporter, victoriametrics-fips, hubble, spiffe-helper, mkcert, rekor, flux-image-reflector-controller, lazygit,...

CVE-2025-8745

A vulnerability, which was classified as problematic, has been found in Weee RICEPO App 6.17.77 on Android. This issue affects some unknown processing of the file AndroidManifest.xml of the component com.ricepo.app. The manipulation leads to improper export of android application components. An...

CVE-2025-8745 Weee RICEPO App com.ricepo.app AndroidManifest.xml improper export of android application components

A vulnerability, which was classified as problematic, has been found in Weee RICEPO App 6.17.77 on Android. This issue affects some unknown processing of the file AndroidManifest.xml of the component com.ricepo.app. The manipulation leads to improper export of android application components. An...

Weee RICEPO App 安全漏洞

Weee RICEPO App is a takeout app from Weee, Inc. A security vulnerability exists in Weee RICEPO App version 6.17.77, which stems from improper export of Android application components...

Huuge Box App 安全漏洞

Huuge Box App is a mobile application from Huuge. A security vulnerability exists in Huuge Box App version 1.0.3, which originates from improper export of Android application components...

Command Injection

Overview agentUniverse is an agentUniverse is a framework for developing applications powered by multi-agent base on large language model. Affected versions of this package are vulnerable to Command Injection via the StdioServerParameters function of the MCPSessionManager/MCPTool/MCPToolkit...