MAL-2025-45788 Malicious code in regulus-pegasus-lacerta-node-config (npm)

The package regulus-pegasus-lacerta-node-config was found to contain malicious code...

MAL-2025-43872 Malicious code in commitlint-config-angular-photon-plutology-bioinformatics (npm)

The package commitlint-config-angular-photon-plutology-bioinformatics was found to contain malicious code...

MAL-2025-43195 Malicious code in @zalastax/nolb-eslint-config-g (npm)

The package @zalastax/nolb-eslint-config-g was found to contain malicious code...

MAL-2025-43194 Malicious code in @zalastax/nolb-eslint-config-f (npm)

The package @zalastax/nolb-eslint-config-f was found to contain malicious code...

MAL-2025-43879 Malicious code in config-subscription-quasar-await (npm)

The package config-subscription-quasar-await was found to contain malicious code...

MAL-2025-43196 Malicious code in @zalastax/nolb-eslint-config-h (npm)

The package @zalastax/nolb-eslint-config-h was found to contain malicious code...

MAL-2025-45737 Malicious code in radioastronomy-node-config-antd-selenium (npm)

The package radioastronomy-node-config-antd-selenium was found to contain malicious code...

MAL-2025-45567 Malicious code in playwright-config-titan-greatfilter (npm)

The package playwright-config-titan-greatfilter was found to contain malicious code...

Malicious code in astrophysics-commitlint-config-angular-unuk-luna (npm)

The package astrophysics-commitlint-config-angular-unuk-luna was found to contain malicious code...

MAL-2025-44722 Malicious code in isostasy-config-astrophysics-stop (npm)

The package isostasy-config-astrophysics-stop was found to contain malicious code...

Malicious code in @auro-formkit/config (npm)

The package @auro-formkit/config was found to contain malicious code...

MAL-2025-42190 Malicious code in @auro-formkit/config (npm)

The package @auro-formkit/config was found to contain malicious code...

Ubuntu 14.04 LTS / 16.04 LTS : KDE PIM vulnerabilities (USN-7729-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7729-1 advisory. Damian Poddebniak, Christian Dresen, Jens Mller, Fabian Ising, Sebastian Schinzel, Simon Friedberger, Juraj Somorovsky, and Jrg Schwenk...

CVE-2025-8614

NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to...

CVE-2023-35657

CVE-2023-35657 affects the Bluetooth stack component bta_av_config_ind in bta_av_aact.cc, where a type confusion can cause an out-of-bounds read leading to local information disclosure without extra privileges or user interaction. Public references indicate this vulnerability is tracked in Androi...

AZL-66860 CVE-2025-38687 affecting package kernel for versions less than 6.6.104.2-1

In the Linux kernel, the following vulnerability has been resolved: comedi: fix race between polling and detaching syzbot reports a use-after-free in comedi in the below link, which is due to comedi gladly removing the allocated async area even though poll requests are still active on the...

CVE-2025-7388 Authenticated Command Injection via configuration parameter manipulation in exposed RMI interface

It was possible to perform Remote Command Execution RCE via Java RMI interface in the OpenEdge AdminServer, allowing authenticated users to inject and execute OS commands under the delegated authority of the AdminServer process. An RMI interface permitted manipulation of a configuration property...

CVE-2025-41045

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'datasconfigethicallicensekey' parameter in /apprain/admin/config/ethical...

CVE-2025-41039

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'datasconfigadminlandingpage', 'datasconfigcurrency', 'datasconfigdbversion', 'datasconfigdefaultpagination',...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the datasconfigethicallicensekey parameter in the /apprain/admin/config/ethical process. An attacker can execute arbitrary JavaScript code in the context of a user's browser by submitting crafted input that ...