CVE-2025-54762

SS1 Ver.16.0.0.10 and earlier Media version:16.0.0a and earlier allows a remote unauthenticated attacker to upload arbitrary files and execute OS commands with SYSTEM privileges...

CVE-2025-54762

CVE-2025-54762 affects SS1 and its Media version (SS1 Ver.16.0.0.10 and earlier; Media 16.0.0a and earlier). The vulnerability enables a remote, unauthenticated attacker to upload arbitrary files and execute OS commands with SYSTEM privileges. Connected sources additionally map this to multiple S...

CVE-2025-53970

CVE-2025-53970 affects SS1 versions 16.0.0.10 and earlier (Media 16.0.0a and earlier) from DOS Co., Ltd. A remote unauthenticated attacker can upload arbitrary files and execute OS commands with SYSTEM privileges. Multiple sources (NVD, Red Hat, JVN, CIRCL, PT Security, etc.) corroborate the vuln...

CVE-2025-53970

SS1 Ver.16.0.0.10 and earlier Media version:16.0.0a and earlier allows a remote unauthenticated attacker to upload arbitrary files and execute OS commands with SYSTEM privileges...

MAL-2025-41501 Malicious code in @twork-data-services/procedure-v2-execute-as-method-request (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-42123 Malicious code in @flight-common/models (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c5af2423bce8f82ab3bebfecba472bdcc04805388481ec19e96c245ca48ccd3b The OpenSSF Package Analysis project identified '@flight-common/models' @ 1.2.9213 npm as malicious. It is considered malicious because: - The...

CVE-2025-57797

Incorrect privilege assignment vulnerability exists in ScanSnap Manager installers versions prior to V6.5L61. If this vulnerability is exploited, an authenticated local attacker may escalate privileges and execute an arbitrary command...

Linux Distros Unpatched Vulnerability : CVE-2019-7342

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - POST - Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable...

CVE-2025-36174 IBM Integrated Analytics System file upload

IBM Integrated Analytics System 1.0.0.0 through 1.0.30.0 could allow an authenticated user to upload a file with dangerous types that could be executed by another user if opened...

Malicious code in ng-tds (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b3294da0f9faffb8ba69b152216b52a8aa4ebcf64678bcd336c917b3e054530d The OpenSSF Package Analysis project identified 'ng-tds' @...

Malicious code in api-extractor-lib4-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 659516491da5eda94919af0b09a941720c55632d3a7c3ced84c056da49b4e504 The OpenSSF Package Analysis project identified 'api-extractor-lib4-test' @ 99.0.9 npm as malicious. It is considered malicious because: - The...

CVE-2025-57749

n8n is a workflow automation platform. Before 1.106.0, a symlink traversal vulnerability was discovered in the Read/Write File node in n8n. While the node attempts to restrict access to sensitive directories and files, it does not properly account for symbolic links symlinks. An attacker with the...

CVE-2025-57771

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions prior to 3.25.5, Roo-Code fails to properly handle process substitution and single ampersand characters in the command parsing logic for auto-execute commands. If a user has enabled auto-approved execution...

CVE-2025-57771 Roo-Code potential remote code execution via auto-execute command parsing flaw

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions prior to 3.25.5, Roo-Code fails to properly handle process substitution and single ampersand characters in the command parsing logic for auto-execute commands. If a user has enabled auto-approved execution...

CVE-2025-57771 Roo-Code potential remote code execution via auto-execute command parsing flaw

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions prior to 3.25.5, Roo-Code fails to properly handle process substitution and single ampersand characters in the command parsing logic for auto-execute commands. If a user has enabled auto-approved execution...

CVE-2025-57771

CVE-2025-57771 affects Roo Code prior to 3.25.5. The flaw lies in the command parsing for auto-execute commands, where process substitution and single ampersand handling can be bypassed, allowing an attacker who can submit crafted prompts to cause arbitrary commands to run alongside the intended ...

CVE-2025-57771 Roo-Code potential remote code execution via auto-execute command parsing flaw

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions prior to 3.25.5, Roo-Code fails to properly handle process substitution and single ampersand characters in the command parsing logic for auto-execute commands. If a user has enabled auto-approved execution...

CVE-2025-38658

In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: Do not complete commands twice if nvmetreqinit fails Have nvmetreqinit and req-execute complete failed commands. Description of the problem: nvmetreqinit calls nvmetreqcomplete internally upon failure, e.g.,...

CVE-2025-38658

CVE-2025-38658 affects the Linux kernel nvmet PCI-EPF path. The issue occurs when nvmet_req_init() fails (e.g., on an unsupported opcode), because __nvmet_req_complete() can trigger queue_response which may call nvmet_pci_epf_complete_iod(), and nvmet_pci_epf_exec_iod_work() may also invoke the s...

CVE-2025-38658 nvmet: pci-epf: Do not complete commands twice if nvmet_req_init() fails

In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: Do not complete commands twice if nvmetreqinit fails Have nvmetreqinit and req-execute complete failed commands. Description of the problem: nvmetreqinit calls nvmetreqcomplete internally upon failure, e.g.,...