MAL-2025-38077 Malicious code in valvo-custom-bs (npm)

The package valvo-custom-bs was found to contain malicious code...

MAL-2025-21707 Malicious code in google-jsdocless (npm)

The package google-jsdocless was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: google-open-source-security f373d78893327920491950970d76c5deb36859c2cbd890bbc815d16536840004 This package installs a dependency hosted on a custom domain that runs a...

MAL-2025-20277 Malicious code in fbjs-opensource (npm)

The package fbjs-opensource was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 2dac438ef7432e162ead36cdd4121d9b31b47eaa1eb4ce24c0e577655dc496a5 This package installs a dependency hosted on a custom domain that runs an...

MAL-2025-14184 Malicious code in airbnb-angular (npm)

The package airbnb-angular was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 7fff1f5000c3707b881be6257856ad35d4e8c37a27f0219b0e380ee46fcae5ea This package installs a dependency hosted on a custom domain that runs an...

MAL-2025-14188 Malicious code in airbnb-es5 (npm)

The package airbnb-es5 was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 8210336cb16ae6428e936268a05b3f57769d39cfc48cbe662870575dc1faf80b This package installs a dependency hosted on a custom domain that runs an info...

MAL-2025-14193 Malicious code in airbnb-lite (npm)

The package airbnb-lite was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 156283cf217f6dbaa79bc5dfcccb51a8febb9f4a1c0bdaee10e0b65dbae8a32c This package installs a dependency hosted on a custom domain that runs an inf...

MAL-2025-17834 Malicious code in custom-mysql2 (npm)

The package custom-mysql2 was found to contain malicious code...

MAL-2025-14192 Malicious code in airbnb-hooks (npm)

The package airbnb-hooks was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 33c430dfd90c926bae8206a1ac92dcb5b15de7ef7b729c5bc8f88452c6793b44 This package installs a dependency hosted on a custom domain that runs an in...

MAL-2025-38668 Malicious code in vue-custom-directives (npm)

The package vue-custom-directives was found to contain malicious code...

MAL-2025-14186 Malicious code in airbnb-bundle (npm)

The package airbnb-bundle was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: google-open-source-security ea6660cd54215b1f9c967e8522156e2728e7ebb64ce3d3052d49f3e41bbffd87 This package installs a dependency hosted on a custom domain that runs an...

httpd: insufficient escaping of user-supplied data in mod_ssl

A vulnerability was found in the Apache HTTP Server. Insufficient escaping of user-supplied data in modssl allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%varnamex" or "%varnamec" to...

httpd: insufficient escaping of user-supplied data in mod_ssl

A vulnerability was found in the Apache HTTP Server. Insufficient escaping of user-supplied data in modssl allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%varnamex" or "%varnamec" to...

WordPress Add Custom Codes <= 4.80 - Arbitrary Code Execution Vulnerability

Arbitrary Code Execution Vulnerability discovered by Ryan Novotny in WordPress Plugin Add Custom Codes versions = 4.80...

CVE-2025-28975

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in redqteam Alike - WordPress Custom Post Comparison alike allows Reflected XSS.This issue affects Alike - WordPress Custom Post Comparison: from n/a through = 3.0.1...

Command Injection

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Command Injection via the CustomMCP class. An attacker can gain unauthorized remote access and execute arbitrary operating system commands by sending crafted requests over the network. This i...

CVE-2025-28975 WordPress Alike - WordPress Custom Post Comparison <= 3.0.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in redqteam Alike - WordPress Custom Post Comparison allows Reflected XSS. This issue affects Alike - WordPress Custom Post Comparison: from n/a through 3.0.1...

CVE-2025-28975 WordPress Alike - WordPress Custom Post Comparison <= 3.0.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in redqteam Alike - WordPress Custom Post Comparison alike allows Reflected XSS.This issue affects Alike - WordPress Custom Post Comparison: from n/a through = 3.0.1...

CVE-2025-28975

CVE-2025-28975 corresponds to a WordPress plugin vulnerability in the Alike – WordPress Custom Post Comparison extension. The issue is a reflected Cross‑Site Scripting (XSS) flaw caused by improper neutralization of user input during web page generation, affecting versions up to and including 3.0...

CVE-2025-8943 Unsupervised OS command execution leads to remote code execution by unauthenticated network attackers

The Custom MCPs feature is designed to execute OS commands, for instance, using tools like npx to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls RBAC. Furthermore, in Flowise versions before 3.0.1 the...

CVE-2025-8943

The Custom MCPs feature is designed to execute OS commands, for instance, using tools like "npx" to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls RBAC. Furthermore, in Flowise versions before 3.0.1 the...