MAL-2025-47365 Malicious code in xo-wallet-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94fd297d5bd2cbf348e88599e570974a4fc9f65f7bf3cdda6bf6a69e8dc8dd44 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47350 Malicious code in tg-client-query-builder (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e88f4b4247a247c45d69b7c6082806c246a97e993f3db259215f30d0774e8db7 Any computer that has this package installed or running should be considered fully compromised. All...

MAL-2025-47151 Malicious code in @nativescript-community/text (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 70e308e7da4975ddec5cf39601e96232abc461d9544cc82745a13e8efd7b4200 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47184 Malicious code in internallib_v89 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 068e1bc120532c54da96dabb589d8d274223c9b1df16cc5aa698eed0def69145 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Linux Distros Unpatched Vulnerability : CVE-2017-0508

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An elevation of privilege vulnerability in the kernel ION subsystem could enable a local malicious application to execute arbitrary code within the context of t...

Linux Distros Unpatched Vulnerability : CVE-2017-0507

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An elevation of privilege vulnerability in the kernel ION subsystem could enable a local malicious application to execute arbitrary code within the context of t...

WhatsApp fixes vulnerability used in zero-click attacks

WhatsApp says it has issued an update to patch a vulnerability that has been used in conjunction with an Apple vulnerability to target specific users and compromise their devices. Reportedly, attackers used this exploit against dozens of WhatsApp users, and WhatsApp has notified those affected:...

CVE-2025-34148

An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater hardware model MT02. When configuring the device in WISP mode, the 'ssid' parameter is passed unsanitized to system-level scripts. This allows remote attackers within Wi-Fi range to inject...

CVE-2025-34148

CVE-2025-34148 concerns an unauthenticated OS command-injection in the Shenzhen Aitemi M300 Wi‑Fi Repeater (hardware model MT02) when configured in WISP mode. The vulnerability stems from the unsanitized handling of the ssid parameter being passed to system-level scripts, enabling remote attacker...

CVE-2025-34148 Shenzhen Aitemi M300 Wi-Fi Repeater OS Command Injection via WISP SSID

An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater hardware model MT02. When configuring the device in WISP mode, the 'ssid' parameter is passed unsanitized to system-level scripts. This allows remote attackers within Wi-Fi range to inject...

PT-2025-32273

Name of the Vulnerable Software and Affected Versions Shenzhen Aitemi M300 Wi-Fi Repeater hardware model MT02 affected versions not specified Description An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater. When configuring the device in WISP...

CVE-2025-6076

Partner Software's Partner Software application and Partner Web application do not sanitize files uploaded on the "reports" tab, allowing an authenticated attacker to upload a malicious file and compromise the device. By default, the software runs as SYSTEM, heightening the severity of the...

CVE-2025-6076

Partner Software's Partner Software application and Partner Web application do not sanitize files uploaded on the "reports" tab, allowing an authenticated attacker to upload a malicious file and compromise the device. By default, the software runs as SYSTEM, heightening the severity of the...

CVE-2025-6076 CVE-2025-6076

Partner Software's Partner Software application and Partner Web application do not sanitize files uploaded on the "reports" tab, allowing an authenticated attacker to upload a malicious file and compromise the device. By default, the software runs as SYSTEM, heightening the severity of the...

PT-2025-31718 · Unknown · Partner Web Application +1

Name of the Vulnerable Software and Affected Versions: Partner Software application and Partner Web application versions 4.32 Partner Software application and Partner Web application affected versions not specified Description: The Partner Software application and Partner Web application do not...

CVE-2013-10050 D-Link Devices tools_vct.xgi Authenticated RCE

An OS command injection vulnerability exists in multiple D-Link routers confirmed on DIR-300 rev A v1.05 and DIR-615 rev D v4.13 via the authenticated toolsvct.xgi CGI endpoint. The web interface fails to properly sanitize user-supplied input in the pingIp parameter, allowing attackers with valid...

Malicious code in request-helmet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 240e3c0e344b97358f5f4788bec6e5e1e1466f45e62d14e98953182412e0827f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tailwind-theme-colors (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 800ed10781a721a0031fd7d044868ae828f7d28ce7f12d2953af3b6bfa3e3412 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in adaptivecards-extras (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware faf58ad9cd734c67c84987538bfdc3425df8d975d05eb6ae506699cee00cc69e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in firefox-puppeteer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c76d6adc7e0c326e775422909c057134c541ee2981946ca82b89f5fd4b86ee3d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...