Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the deployments configured with ACME and SCEP provisioners. An attacker can gain unauthorized access to sensitive resources by bypassing authorization controls. Remediation Upgrade...

GHSA-9QR9-H5GF-34MP

creationtimestamp| type| source ---|---|--- 2025-12-03 16:43:56+00:00| seen| https://bsky.app/profile/hnws.bsky.social/post/3m73vpks5fm2i 2025-12-03 17:00:30+00:00| seen| https://bsky.app/profile/hnbot.gsuscs.xyz/post/3m73wn646xc2m 2025-12-03 17:07:45+00:00| seen|...

Exposed Dangerous Method or Function

Overview Affected versions of this package are vulnerable to Exposed Dangerous Method or Function via the sse or streaming transport modes. An attacker can gain unauthorized access to internal resources by tricking a victim into visiting a malicious website or serving a malicious advertisement...

CVE-2025-62575

creationtimestamp| type| source ---|---|--- 2025-12-03 06:10:08+00:00| seen| https://bsky.app/profile/blackwiremedia.bsky.social/post/3m72sc7m7zc2g 2025-12-03 07:42:50+00:00| seen| https://gist.github.com/Darkcrai86/61cfb0b7823317e3619ec7a2c6465b58 2025-12-03 08:03:29+00:00| seen|...

poc-finder

PoC Finder – Threat Intelligence → PoC Search Introductio...

Oracle Linux 10 : ELSA-2025-20478-0: / zziplib (ELSA-2025-204780)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-204780 advisory. 0.13.78-2 - Fix directory traversal in unzip binary - Disable the CVE tests during the check phase - the reproducers for these are downloaded from the github...

A Comprehensive Study on the Impact of Vulnerable Dependencies on Open-Source Software

Open-source libraries are widely used by software developers to speed up the development of products, however, they can introduce security vulnerabilities, leading to incidents like Log4Shell. With the expanding usage of open-source libraries, it becomes even more imperative to comprehend and...

GHSA-9H52-P55H-VW2F

creationtimestamp| type| source ---|---|--- 2025-12-02 19:07:58+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115651541601478240...

Directory Traversal

Overview rxiv-maker is a Write scientific preprints in Markdown. Generate publication-ready PDFs efficiently. Affected versions of this package are vulnerable to Directory Traversal due to insufficient sanitization of GitHub name input. The GitHub name validation logic fails to strip path...

Arbitrary Code Injection

Overview kagura-ai is an Universal AI Memory Platform - MCP-native context management for all AI agents Affected versions of this package are vulnerable to Arbitrary Code Injection due to missing access restrictions in multiple tool endpoints, including codingindexsourcecode,...

Missing Authorization

Overview github-webhook-server is an A webhook server to manage Github repositories and pull requests. Affected versions of this package are vulnerable to Missing Authorization via unsafe loading of OWNERS files from pull-request–controlled repository checkouts. The...

MCP Watch has a Critical Command Injection in cloneRepo allows Remote Code Execution (RCE) via malicious URL

Summary The MCPScanner class contains a critical Command Injection vulnerability in the cloneRepo method. The application passes the user-supplied githubUrl argument directly to a system shell via execSync without sanitization. This allows an attacker to execute arbitrary commands on the host...

Security Bulletin: NVIDIA Triton Inference Server - December 2025

NVIDIA has released a software update for NVIDIA Triton Inference Server to address the issue disclosed in this bulletin. To protect your system, install the latest release from the Triton Inference Server Releases page on GitHub, and view the Secure Deployment Considerations Guide. Go to NVIDIA...

CVE-2025-66401

MCP Watch is a comprehensive security scanner for Model Context Protocol MCP servers. In 0.1.2 and earlier, the MCPScanner class contains a critical Command Injection vulnerability in the cloneRepo method. The application passes the user-supplied githubUrl argument directly to a system shell via...

GHSA-662M-56V4-3R8F

creationtimestamp| type| source ---|---|--- 2025-12-01 21:04:49+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115646338745778362...

CVE-2025-66297

creationtimestamp| type| source ---|---|--- 2025-12-01 15:55:48+00:00| published-proof-of-concept| https://github.com/getgrav/grav/security/advisories/GHSA-858q-77wx-hhx6...

⚡ Weekly Recap: Hot CVEs, npm Worm Returns, Firefox RCE, M365 Email Raid & More

Hackers aren't kicking down the door anymore. They just use the same tools we use every day — code packages, cloud accounts, email, chat, phones, and "trusted" partners — and turn them against us. One bad download can leak your keys. One weak vendor can expose many customers at once. One guest...

CVE-2018-17082

creationtimestamp| type| source ---|---|--- 2025-12-01 07:51:52+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2018/CVE-2018-17082.yaml 2025-12-02 21:02:28+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3m6ztowc7ky2w 2026-01-27...

PT-2025-48575

Name of the Vulnerable Software and Affected Versions MCP Watch versions 0.1.2 and earlier Description MCP Watch, a security scanner for Model Context Protocol MCP servers, contains a Command Injection issue in the cloneRepo method of the MCPScanner class. The application directly passes the...

CVE-2023-41954

creationtimestamp| type| source ---|---|--- 2025-11-29 23:34:16+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2023/CVE-2023-41954.yaml 2025-12-01 21:02:38+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3m6xda5caqj2w...