CVE-2025-13595 CIBELES AI <= 1.10.8 - Unauthenticated Arbitrary File Upload

The CIBELES AI plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check in the 'actualizadorgit.php' file in all versions up to, and including, 1.10.8. This makes it possible for unauthenticated attackers to download arbitrary GitHub repositories and overwrite...

CVE-2025-13595

CIBELES AI WordPress plugin vulnerability (CVE-2025-13595) arises from a missing capability check in actualizador_git.php, affecting all versions up to 1.10.8. Unauthenticated attackers can perform arbitrary file uploads, enabling retrieval of GitHub repos and overwriting plugin files on the serv...

GO-2025-4157 Babylon's malformed vote extensions are not rejected in github.com/babylonlabs-io/babylon

Babylon's malformed vote extensions are not rejected in github.com/babylonlabs-io/babylon...

GO-2025-4149 OSV-SCALIBR has NULL Pointer Dereference in github.com/google/osv-scalibr

OSV-SCALIBR has NULL Pointer Dereference in github.com/google/osv-scalibr...

Exploit for CVE-2025-13595

CIBELES AI extractTo$extractDir; $rootInsideZip = $extrac...

Malicious code in @posthog/postgres-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10be24eebbc464a61788d5c151ce03171d4abe4b1cd7f27972fef642fc46deda The package @posthog/postgres-plugin was found to contain malicious code. Source: google-open-source-security...

Malicious code in @productdevbook/ts-i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3152cc79cb103f8af6266254c613952272ccb9481db9fb8f299a3fdfa6db7a9 The package @productdevbook/ts-i18n was found to contain malicious code. Source: google-open-source-security...

Malicious code in @voiceflow/natural-language-commander (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcffcb39c546d02117506c26844a1fddcedc61f18cd934b27642817c62189437 The package @voiceflow/natural-language-commander was found to contain malicious code. Source: ghsa-malware...

Malicious code in @voiceflow/sdk-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94c336d86664e23cb704d71c0c615684279844043450c16ee4bd2e434af95435 The package @voiceflow/sdk-runtime was found to contain malicious code. Source: ghsa-malware...

Malicious code in @pergel/module-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ce0c82f79656be99edeef5afbd890a8a5720c0a0e6acbdd2ce273ed8c151c2c The package @pergel/module-graphql was found to contain malicious code. Source: google-open-source-security...

Malicious code in @oku-ui/portal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0711033d654f75b42d8959721555bcf5aa5fb766ccc12b6e89c56eef0d8cafd The package @oku-ui/portal was found to contain malicious code. Source: google-open-source-security...

Malicious code in @oku-ui/menu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c596c8e5c233827737327907a4b122e7fc154c1865ba347b975cd3dda7b591a9 The package @oku-ui/menu was found to contain malicious code. Source: google-open-source-security...

Malicious code in @voiceflow/commitlint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0318a598c3e523953b57c870305c3d1237a290a253f3d69dd9f24bf6ba079d6e The package @voiceflow/commitlint-config was found to contain malicious code. Source: ghsa-malware...

Malicious code in hyper-fullfacing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9c05ea2ff38a274ac4ddcadb9206e1f6d6736e32ce536e149160e99fdd37ba7 The package hyper-fullfacing was found to contain malicious code. Source: ghsa-malware 0068679876dedee5d5fc8affa29f353019af199cd3a22493bc1e122f440b32...

Malicious code in @voiceflow/base-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58f955f868f3684364e34509e8ac923e40a6b84bf081690378886f6a64d77721 The package @voiceflow/base-types was found to contain malicious code. Source: ghsa-malware...

Malicious code in @voiceflow/eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4db5527f8a6098b9553e656b50ee1e0fcae45b163917de83299e9e5200ff96f The package @voiceflow/eslint-config was found to contain malicious code. Source: ghsa-malware...

Malicious code in @voiceflow/voiceflow-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64870c57f06fc059636a3136cce3f775121952fa37459d740810067378d88c0e The package @voiceflow/voiceflow-types was found to contain malicious code. Source: ghsa-malware...

Malicious code in @huntersofbook/i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ca8379240118a39aaed6773c2c07b3212816dcaa38318220594f99d6d31c3f5 The package @huntersofbook/i18n was found to contain malicious code. Source: google-open-source-security...

Malicious code in @oku-ui/collection (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 881324e8071cf3faabccf492103c5280af893332c6a40845e781826209b86b0f The package @oku-ui/collection was found to contain malicious code. Source: google-open-source-security...

Malicious code in @voiceflow/nestjs-redis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e418bb230f36e6cbd5feaa2ec800cf58fa1e701bcf7b8fd1dd8806223a94c645 The package @voiceflow/nestjs-redis was found to contain malicious code. Source: ghsa-malware...