MAL-2025-46980 Malicious code in strip-ansi (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3736bb5cc515b07f47ad6b5bb06c367271994c4b6606f1ddeb91a056788c34c2 Any computer that has this package installed or running should be considered fully compromised. All...

MAL-2025-46977 Malicious code in is-arrayish (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb234972f25697d7cb6b5fee49c919d030c6f82ca0fa9068cc69f3bed952d540 Any computer that has this package installed or running should be considered fully compromised. All...

MAL-2025-46974 Malicious code in debug (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 558d1dda312e85212121f4ed15340349f780f5e40d6685c3687648bbb2924381 Any computer that has this package installed or running should be considered fully compromised. All...

CVE-2025-58371

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions 3.26.6 and below, a Github workflow used unsanitized pull request metadata in a privileged context, allowing an attacker to craft malicious input and achieve Remote Code Execution RCE on the Actions runner...

Malicious code in yui2-treeview (npm)

The package yui2-treeview was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe84263428228e04358ddd36ac76a8372fa21980918b3a9acd4144397683ea32 Any computer that has this package installed or running should be considered fully...

Malicious code in rtk-wake (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6fc493187ac88a35f426edb64ab97f58fcd188ce208058c832d5bd05143ec899 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in library.cycle.e (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 73b010d9a667293958470880270b863c3eae2d00bdca71e08f3bddcbfd0947c6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mathy-console (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 40181e61c8885579610a7982c1d9bb6de781022905e9b58618fd8206ba45347b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tailwind-config-overrides (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0ac45edafa6ddcf4af5c1970929875bc85e162994b1e4a7e3f607529e1425763 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-42134 Malicious code in polyfliof92 (npm)

The package polyfliof92 was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4387ae12209d330b510d4b61ae05eaed4bf1771880ccf8f8df83711e29b6a0e8 Any computer that has this package installed or running should be considered fully...

PT-2025-34938

Name of the Vulnerable Software and Affected Versions: Dahua Smart Park Integrated Management Platform also referred to as the Dahua Smart Campus Integrated Management Platform affected versions not specified Description: A path traversal vulnerability exists in the SOAP-based GIS bitmap upload...

Malicious code in donuts.node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9bd852600a317ae1df99af9e6cede53d3f54d36b9a400ca672eff6a7146818a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in apollo-ms (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d475a426c61513aa519a888a0b2e6968223fdcf3b3ea86c39f8bd0777207c40 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fb_helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fd02d94679b40d95c81b651a29666a45452deabc83d8e33032104032eef13261 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

📄 Ilevia EVE X1 Server 4.7.18.0.eden Credentials Leak

A critical vulnerability was identified in the EVE smart home and BMS/BAS controller system due to improper handling of sensitive information in server-side logging. Specifically, .log files accessible via the web server expose cleartext credentials, including username and password submitted duri...

Malicious code in monitor-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51b3ec369d2a6afae57510092891fcd5712904ac9b195a9bd20099aa37d9c079 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tileuploader (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49889bb016c747fa54e8209157636844c077cd30f04900834d578905f47b61c1 Any computer that has this package installed or running should be considered...

CVE-2011-10017 Snort Report nmap.php/nbtscan.php RCE

Snort Report versions 1.3.2 contains a remote command execution vulnerability in the nmap.php and nbtscan.php scripts. These scripts fail to properly sanitize user input passed via the target GET parameter, allowing attackers to inject arbitrary shell commands. Exploitation requires no...

CVE-2011-10017

Snort Report is vulnerable in versions prior to 1.3.2 due to improper sanitization in the nmap.php and nbtscan.php scripts. The vulnerability allows remote command execution via the target GET parameter with no authentication, potentially resulting in full system compromise. Public reports and CV...

CVE-2013-10070

PHP-Charts v1.0 contains a PHP code execution vulnerability in wizard/url.php, where user-supplied GET parameter names are passed directly to eval without sanitization. A remote attacker can exploit this flaw by crafting a request that injects arbitrary PHP code, resulting in command execution...