Malicious code in @agateh/solana-headless-adapter-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45f33c6ddd09439d626d2670e9e3fc38e407415cf98fb2f96b5f3d4d2dda52dc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in architecture-viewer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4282b66b0052ca80f8717181dbf7b0b94e88433b9e37f9ae718531960f9ddcbd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

External Control of File Name or Path

Overview aim is a super-easy way to record, search and compare AI experiments. Affected versions of this package are vulnerable to External Control of File Name or Path via the restorerunbackup function. An attacker can write arbitrary data to arbitrary locations on the host server by controlling...

External Control of File Name or Path

Overview dbgpt is a DB-GPT is an experimental open-source project that uses localized GPT large models to interact with your data and environment. With this solution, you can beassured that there is no risk of data leakage, and your data is 100% private and secure. Affected versions of this packa...

External Control of Assumed-Immutable Web Parameter

Overview sylius/paypal-plugin is a PayPal plugin for Sylius. Affected versions of this package are vulnerable to External Control of Assumed-Immutable Web Parameter. The user-input payment amount is not adequately confirmed to be the same between payment completion and order authorization, in...

Malicious code in tasks_mangement (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f5af70a269afd5435306a85b902070f929d511d8855e369cc7c930a9dc50be50 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

External Control of Assumed-Immutable Web Parameter

Overview sylius/paypal-plugin is a PayPal plugin for Sylius. Affected versions of this package are vulnerable to External Control of Assumed-Immutable Web Parameter. The user-input payment amount is not adequately confirmed to be the same between initial entry and payment completion, in...

CVE-2023-45588

An external control of file name or path vulnerability CWE-73 in FortiClientMac version 7.2.3 and below, version 7.0.10 and below installer may allow a local attacker to execute arbitrary code or commands via writing a malicious configuration file in /tmp before starting the installation process...

CVE-2023-45588

An external control of file name or path vulnerability CWE-73 in FortiClientMac version 7.2.3 and below, version 7.0.10 and below installer may allow a local attacker to execute arbitrary code or commands via writing a malicious configuration file in /tmp before starting the installation process...

CVE-2025-24996

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network...

Malicious code in smart-power-strip (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e1cc33c4b430e08bef89e4f67199d79002235613631ee986f8566d757fc14ea7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2379 Malicious code in elementor-editor-github-actions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 72f60b6d3f909084d15e59acc80082db35f713c520dc29ff74ec2a79ceb33dcf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dvd-ai-pc-rag (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a767db3d0d8194ea0442ea2138060477dfc8356ba986a5e7a707145af45d9427 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in events-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ab45d10dfa09f0ea69e25ef62c978634d9b929402d3875a2687180c005723eca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in npm-testlist (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 719312e2aaf577f4308c89250b75cd26b241aa1e8e15fa6f3eb9392d5a7a67d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in chialisp-lsp-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aeede289ccdfe7d4487e01b4eb54ed16a8666295df50031d9369d92f75d0d51e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-24996

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network...

CVE-2025-24054

CVE-2025-24054 is a Windows NTLM vulnerability allowing an attacker to induce NTLMv2-SSP hash disclosure by leveraging explorer.exe to fetch remote SMB resources via crafted file types (notably .library-ms and .lnk/.library-ms payloads). Public PoCs and exploits demonstrate creating malicious .li...

MAL-2025-2181 Malicious code in makerspace-cpx-intro (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f001e9f23b801fb8c275858b50785d657d092aac3e06e694490e7e4b5dd0ae1a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2081 Malicious code in @roku-web-ui/legacy-styleguide (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64351a60460f32a078a6792ac73191925335220106d05dc9d59eb22c56281b3d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...