Malicious code in kagi_browser_ext (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d43b7fd2a47594e2b75e6634bd546cec8f3fb5d8c20181ce0f6ed15e368a91bb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in blockzie-link (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3209d64326bd799c5863c01555419390a8c7b7973fa38222b434cea7838b6f81 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2648 Malicious code in blockzie-gui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf83c5547a44227263a682edde74a7f24d42f2068c473e9aaf2a9af949d6bb58 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Mageia: Security Advisory (MGASA-2025-0109)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MGASA-2025-0109 Updated expat packages fix security vulnerability

Improper restriction of xml entity expansion depth in libexpat. CVE-2024-8176 NOTE: upstream deemed this fix incomplete after it was initially pushed. The complete fix was submitted along with the fix for CVE-2025-59375...

Updated expat packages fix security vulnerability

Improper restriction of xml entity expansion depth in libexpat. CVE-2024-8176 NOTE: upstream deemed this fix incomplete after it was initially pushed. The complete fix was submitted along with the fix for CVE-2025-59375...

CVE-2025-25036

Improper Restriction of XML External Entity Reference vulnerability in Jalios JPlatform allows XML Injection.This issue affects all versions of JPlatform 10 before 10.0.8 SP8...

CVE-2025-25036 Jalios JPlatform 10 Authenticated XML External Entity Injection (XXE)

Improper Restriction of XML External Entity Reference vulnerability in Jalios JPlatform allows XML Injection.This issue affects all versions of JPlatform 10 before 10.0.8 SP8...

CVE-2025-25036 Jalios JPlatform 10 Authenticated XML External Entity Injection (XXE)

Improper Restriction of XML External Entity Reference vulnerability in Jalios JPlatform allows XML Injection.This issue affects all versions of JPlatform 10 before 10.0.8 SP8...

CVE-2025-25036

Jalios JPlatform is affected by CVE-2025-25036 (XML External Entity Reference leading to XML Injection) in all versions prior to 10.0.8 (SP8). The issue is due to improper restriction of external entities, enabling XML injections under network access. Reported impact focuses on confidentiality ri...

Jalios JPlatform 安全漏洞

Jalios JPlatform is a digital work platform from Jalios, Inc. A security vulnerability exists in Jalios JPlatform versions prior to 10.0.8, which stems from an improperly restricted XML external entity reference that could lead to XML injection...

CVE-2025-25036: Improper Restriction of XML External Entity Reference

Improper Restriction of XML External Entity Reference vulnerability in Jalios JPlatform allows XML Injection.This issue affects all versions of JPlatform 10 before 10.0.8 SP8...

CVE-2025-25589

An XML external entity XXE injection vulnerability in the component /weixin/aes/XMLParse.java of yimioa before v2024.07.04 allows attackers to execute arbitrary code via supplying a crafted XML file...

MAL-2025-2573 Malicious code in keypair-encryption (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1265d869c665e7bb42b4827bc9f51ad572b2ce181edebfc84eeb5698e0e39048 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

DRUPAL-CONTRIB-2025-024

This module adds a formatter for link fields that displays the current entity with another view mode inside the link. Drupal core does not sufficiently sanitize link element attributes, which can lead to a Cross Site Scripting vulnerability XSS. A separate fix for Drupal core has been released bu...

CVE-2025-2365

A vulnerability, which was classified as problematic, has been found in crmebjava up to 1.3.4. Affected by this issue is the function webHook of the file WeChatMessageController.java. The manipulation leads to xml external entity reference. The attack may be launched remotely. The exploit has bee...

CVE-2025-25589

An XML external entity XXE injection vulnerability in the component /weixin/aes/XMLParse.java of yimioa before v2024.07.04 allows attackers to execute arbitrary code via supplying a crafted XML file...

Malicious code in pendeck (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 52144cad81187f6ac538b8ed921e0d500b9094449083bb6f7d408e5e7b6ba2d3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tokesjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77cf2bffbafed158e996b9fb6581994a5dda5f00137197ee10e3538b2e68eeb9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gash (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0d7e92080b720d7d708537639734002025adb32846e183163eab64fed19c17e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...