Exploit for Improper Neutralization of Special Elements Used in a Template Engine in Invisioncommunity

CVE-2025-47916 - Invision Community Remote Code Execution RCE...

EUVD-2025-198355

Claude Code is an agentic coding tool. Prior to version 2.0.31, due to an error in sed command parsing, it was possible to bypass the Claude Code read-only validation and write to arbitrary files on the host system. This issue has been patched in version 2.0.31...

EUVD-2025-198308

SOPlanning is vulnerable to Stored XSS in /taches endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when opening editor. This issue was fixed in version 1.55...

EUVD-2025-198309

SOPlanning is vulnerable to Stored XSS in /groupeform endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when opening editor. This issue was fixed in version 1.55...

EUVD-2025-198326

Malicious code in @ra-ide/tag-editor-frontend npm...

MAL-2025-190597 Malicious code in @ra-ide/tag-editor-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c33209550ea4f214f4a53a91ca86598ef1ba273d7dae04de11effd081d8cd75 The package @ra-ide/tag-editor-frontend was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in @ra-ide/tag-editor-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c33209550ea4f214f4a53a91ca86598ef1ba273d7dae04de11effd081d8cd75 The package @ra-ide/tag-editor-frontend was found to contain malicious code. Source: ossf-package-analysis...

EUVD-2025-198328

Malicious code in @ra-ide/code-editor-frontend npm...

MAL-2025-190590 Malicious code in @ra-ide/code-editor-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39784fd9275723725034c0f9fcb2df35d06963659572a3aeaccd51e3a5e07e61 The package @ra-ide/code-editor-frontend was found to contain malicious code. Source: ossf-package-analysis...

CVE-2025-62296

SOPlanning is vulnerable to Stored XSS in /taches endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when opening editor. This issue was fixed in version 1.55...

CVE-2025-62296

SOPlanning is vulnerable to Stored XSS in the /taches endpoint. A malicious user with medium privileges can inject HTML/JS that is rendered when opening the editor. The issue has a fixed patch in version 1.55. No exploit details are provided beyond the public vulnerability description in the conn...

CVE-2025-62296 Stored XSS in SOPlanning

SOPlanning is vulnerable to Stored XSS in /taches endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when opening editor. This issue was fixed in version 1.55...

CVE-2025-62295 Stored XSS in SOPlanning

SOPlanning is vulnerable to Stored XSS in /groupeform endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when opening editor. This issue was fixed in version 1.55...

CVE-2025-62295

SOPlanning is vulnerable to Stored XSS in /groupe_form endpoint. An authenticated attacker with medium privileges can inject arbitrary HTML/JS that is rendered/executed when opening the editor. Root cause: insufficient input validation on the group form storage path. Impact per sources: causes co...

PT-2025-47595

Name of the Vulnerable Software and Affected Versions SOPlanning versions prior to 1.55 Description SOPlanning is susceptible to a Stored Cross-Site Scripting XSS issue in the /groupe form endpoint. An attacker with medium privileges can inject arbitrary HTML and JavaScript code into the website...

Lite XL 安全漏洞

Lite XL is a lightweight text editor from lite-xl open source. A security vulnerability exists in Lite XL 2.1.8 and earlier versions, which stems from the automatic execution of the .liteproject.lua file and could lead to the execution of arbitrary code...

CVE-2025-34336

Affected software: eGovFramework/egovframe-common-components

CVE-2025-34337 eGovFramework <= 4.3.1 Unauthenticated Encryption Oracle via Web Editor Image Upload Endpoints

eGovFramework/egovframe-common-components versions up to and including 4.3.1 includes Web Editor image upload and related file delivery functionality that uses symmetric encryption to protect URL parameters, but exposes an encryption oracle that allows attackers to generate valid ciphertext for...

SUSE-SU-2025:4137-1 Security update for gimp

This update for gimp fixes the following issues: - CVE-2025-10934: Fixed XWD file parsing heap-based buffer overflow vulnerability bsc1252886...

Malicious code in cline-ai-main.cline-ai-agent (VSCode)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 04aeefbf39e1e9157280b91899a141e4f4c6619d434c594e4a2d3bf43883dbe6 This extension is malicious. When installed it runs an info stealer that exfiltrates user data including credentials and cryptocurrency...