Eval Injection

Overview isaaclab is an Isaac Lab Affected versions of this package are vulnerable to Eval Injection via the SB3 configuration parsing. An attacker can execute arbitrary code, escalate privileges, cause denial of service, disclose sensitive information, or tamper with data by providing a speciall...

EUVD-2025-34448

An issue in the Configure New Cluster interface of kafka-ui v0.6.0 to v0.7.2 allows attackers to cause a Denial of Service DoS via uploading a crafted configuration file...

EUVD-2025-34326

Out-of-bounds read in Windows WLAN Auto Config Service allows an authorized attacker to disclose information locally...

CVE-2025-57618

A path traversal vulnerability in FastX3 thru 3.3.67 allows an unauthenticated attacker to read arbitrary files on the server. By leveraging this vulnerability, it is possible to access the application's configuration files, which contain the secret key used to sign JSON Web Tokens as well as...

Astra Linux - уязвимость в linux-5.10

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Initialize frame-based format color matching descriptor Fix NULL pointer crash in uvcgframebasedmake due to uninitialized color matching descriptor for frame-based format which was added in commit f5e7bdd34aca...

CVE-2025-55695

Out-of-bounds read in Windows WLAN Auto Config Service allows an authorized attacker to disclose information locally...

CVE-2025-55695

Out-of-bounds read in Windows WLAN Auto Config Service allows an authorized attacker to disclose information locally...

CVE-2025-62156 argo-workflows Zip Slip path traversal allows arbitrary file write and container configuration overwrite

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Versions prior to 3.6.12 and versions 3.7.0 through 3.7.2 contain a Zip Slip path traversal vulnerability in artifact extraction. During artifact extraction the unpack/untar logic...

CVE-2025-7329 Rockwell Automation Comms - 1783-NATR Stored Cross-Site Scripting Vulnerability

A Stored Cross-Site Scripting security issue exists in the affected product that could potentially allow a malicious user to view and modify sensitive data or make the webpage unavailable. The vulnerability stems from missing special character filtering and encoding. Successful exploitation...

CVE-2025-57618

A path traversal vulnerability in FastX3 thru 3.3.67 allows an unauthenticated attacker to read arbitrary files on the server. By leveraging this vulnerability, it is possible to access the application's configuration files, which contain the secret key used to sign JSON Web Tokens as well as...

CVE-2025-57618

A path traversal vulnerability in FastX3 thru 3.3.67 allows an unauthenticated attacker to read arbitrary files on the server. By leveraging this vulnerability, it is possible to access the application's configuration files, which contain the secret key used to sign JSON Web Tokens as well as...

PT-2025-41911

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A Stored Cross-Site Scripting issue exists that could allow a malicious user to view and modify sensitive data or make the webpage unavailable. The issue is due...

CVE-2025-62363

yt-grabber-tui is a terminal user interface application for downloading videos. In versions before 1.0-rc, the application allows users to configure the path to the yt-dlp executable via the pathtoytdlp configuration setting. An attacker with write access to the configuration file or the filesyst...

CVE-2025-61929

Cherry Studio is a desktop client that supports for multiple LLM providers. Cherry Studio registers a custom protocol called cherrystudio://. When handling the MCP installation URL, it parses the base64-encoded configuration data and directly executes the command within it. In the files...

Malicious code in eslint-config-jest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a8136cf5c3645f0d663343578a6f6592474f35014323fd59a5cd067962473bb6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview eslint-config-jest is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

EUVD-2025-33943

Malicious code in eslint-config-jest npm...

MAL-2025-48323 Malicious code in eslint-config-jest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a8136cf5c3645f0d663343578a6f6592474f35014323fd59a5cd067962473bb6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview stylelint-config-twbs-applestrap is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

PT-2025-51626

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the idpf driver related to the removal of the driver. Specifically, a NULL pointer dereference can occur in the idpf remove function when attempti...