EUVD-2025-199342

Malicious code in @alexadark/gatsby-theme-events npm...

MAL-2025-191182 Malicious code in @alexadark/gatsby-theme-events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8516b639c9bdcc54192b6e206090c381522d0f48987715c16f5c68a90ca3b8f4 The package @alexadark/gatsby-theme-events was found to contain malicious code. Source: ghsa-malware...

Linux Distros Unpatched Vulnerability : CVE-2025-62400

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups. This could reveal private or...

EUVD-2025-199097

Malicious code in @posthog/drop-events-on-property-plugin npm...

MAL-2025-190946 Malicious code in @posthog/drop-events-on-property-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1dee879dbf8f8819008c31e641e4fec6584690087c6929cba530e9171464cb4 The package @posthog/drop-events-on-property-plugin was found to contain malicious code. Source: ghsa-malware...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

CVE-2025-13466

creationtimestamp| type| source ---|---|--- 2025-11-24 18:40:14+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3m6fhz63cvk2n 2025-11-24 18:44:17+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3m6fiagi6fc2n...

Authorization Bypass

Liferay Portal and Liferay DXP are vulnerable to Authorization Bypass. The vulnerability is due to improper access control on the comliferayportalsecurityauditwebportletAuditPortletauditEventId parameter, which allows an authenticated attacker in one virtual instance to view audit events belongin...

The vulnerability of the setBit() function in the include/trace/events/fscache.h module of the Linux operating system’s kernel allows a hacker to cause a service failure.

The vulnerability of the setBit function in the include/trace/events/fscache.h module of the Linux kernel’s firmware is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

More on Rewiring Democracy

It's been a month since Rewiring Democracy: How AI Will Transform Our Politics, Government, and Citizenship was published. From what we know, sales are good. Some of the book's forty-three chapters are available online: chapters 2, 12, 28, 34, 38, and 41. We need more reviews--six on Amazon is no...

GHSA-547R-QMJM-8HVW

creationtimestamp| type| source ---|---|--- 2025-11-21 14:49:21+00:00| seen| https://bsky.app/profile/736b.moe/post/3m65jpnbetg2w 2025-11-21 14:50:40+00:00| seen| https://bsky.app/profile/736b.moe/post/3m65jrxzeqx2p 2025-11-21 22:25:21+00:00| seen|...

WordPress Community Events plugin SQL Injection Vulnerability

WordPress Community Events plugin is an event management plugin on the WordPress platform , mainly used to create and display the event calendar , support for AJAX dynamic loading and event submission form features . WordPress Community Events plugin suffers from a SQL injection vulnerability tha...

CVE-2025-12646

The Community Events plugin for WordPress is vulnerable to SQL Injection via the 'dayofyear' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

TencentOS Server 3: libreoffice (TSSA-2022:0038)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2022:0038 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

CVE-2025-65021

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference IDOR vulnerability exists in the poll finalization feature of the application. Any authenticated user can finalize a poll they do not own by manipulating the pollId parameter in...

EUVD-2025-198116

The Community Events plugin for WordPress is vulnerable to SQL Injection via the 'dayofyear' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2025-12646

The Community Events plugin for WordPress is vulnerable to SQL Injection via the 'dayofyear' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2025-12646 Community Events <= 1.5.4 - Unauthenticated SQL Injection

The Community Events plugin for WordPress is vulnerable to SQL Injection via the 'dayofyear' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2025-12646 Community Events <= 1.5.4 - Unauthenticated SQL Injection

The Community Events plugin for WordPress is vulnerable to SQL Injection via the 'dayofyear' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

PT-2025-47430

Name of the Vulnerable Software and Affected Versions WordPress Community Events plugin versions prior to 1.5.5 Description The WordPress Community Events plugin is susceptible to SQL Injection due to inadequate input validation and query preparation. Specifically, the dayofyear parameter is not...