PT-2025-45512

Name of the Vulnerable Software and Affected Versions KubeVirt versions prior to 1.5.3 KubeVirt versions prior to 1.6.1 Description KubeVirt is a virtual machine management add-on for Kubernetes. A flaw exists in the peer verification logic within virt-handler via the verifyPeerCert function. An...

EUVD-2025-37947

Malicious code in rbx-handler npm...

Malicious Package

Overview rbx-handler is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious code in rbx-handler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d4ecda15069813165d8d13bb57d1f3897a9cf9ff78f99e9351d6f70718652a0 The package rbx-handler was found to contain malicious code. Source: ghsa-malware f13b7df25e6160dc2918d838b4d1f1823318fa34c5e29990e87a57a293c0e0d9 An...

MAL-2025-49374 Malicious code in rbx-handler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d4ecda15069813165d8d13bb57d1f3897a9cf9ff78f99e9351d6f70718652a0 The package rbx-handler was found to contain malicious code. Source: ghsa-malware f13b7df25e6160dc2918d838b4d1f1823318fa34c5e29990e87a57a293c0e0d9 An...

CVE-2025-12469 FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.6.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending

The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.6.4.1. This is due to the plugin not properly verifying that a user is authorized to perform administrativ...

CVE-2025-11835

The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability and validation check on the PMSAJAXCheckoutHandler::processpayment function in all versions up t...

CVE-2025-11835 Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.16.4 - Missing Authorization to Unauthenticated Arbitrary Member Subscription Auto Renewal

The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability and validation check on the PMSAJAXCheckoutHandler::processpayment function in all versions up t...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989401)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989401 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/lima: mask irqs in timeout path before hard reset There is a race condition in which a...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-990104)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990104 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Prevent buffer overflow in setup handler Setup function uvcfunctionsetup permit...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990315)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990315 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/lima: mask irqs in timeout path before hard reset There is a race condition in which a...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989284)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989284 advisory. In the Linux kernel, the following vulnerability has been resolved: rtc: cmos: Fix event handler registration ordering issue Because acpiinstallfixedeventhandler...

Simple Online Hotel Reservation System Code Issue Vulnerability

Simple Online Hotel Reservation System is a simple online hotel reservation system. Simple Online Hotel Reservation System has a code issue vulnerability that stems from a lack of valid validation of uploaded files by the Photo Handler component in file /admin/editroom.php. An attacker can use th...

CVE-2025-12623

A vulnerability was identified in fushengqian fuint up to 41e26be8a2c609413a0feaa69bdad33a71ae8032. Affected by this issue is some unknown functionality of the file fuint-application/src/main/java/com/fuint/module/clientApi/controller/ClientSignController.java of the component Authentication Toke...

CVE-2025-12070

The ViaAds plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.2. This is due to missing nonce validation on the ViaAdspluginHandler function. This makes it possible for unauthenticated attackers to modify the plugin's API key and cookie...

CVE-2025-12623

A vulnerability was identified in fushengqian fuint up to 41e26be8a2c609413a0feaa69bdad33a71ae8032. Affected by this issue is some unknown functionality of the file fuint-application/src/main/java/com/fuint/module/clientApi/controller/ClientSignController.java of the component Authentication Toke...

CVE-2025-12593

A vulnerability was identified in code-projects Simple Online Hotel Reservation System 2.0. The impacted element is an unknown function of the file /admin/editroom.php of the component Photo Handler. The manipulation leads to unrestricted upload. The attack is possible to be carried out remotely...

GHSA-WCW9-47FP-RRFR vulnerabilities

Vulnerabilities for packages: cluster-api-gcp-controller, kubeflow, crane, helm-set-status, terraform-provider-kubernetes, timoni, runc, podinfo, maru, vault-env, mage, cargobump, vault-k8s, juicefs, speedtest-go, pvc-autoresizer, k3d, delve, s5cmd, wgcf, cluster-api-provider-vsphere, dive,...

GHSA-FRHW-MQJ2-WXW2 vulnerabilities

Vulnerabilities for packages: terraform-provider-kubernetes, helm-set-status, juicefs, k3d, pombump, delve, s5cmd, cluster-api-provider-vsphere, conftest, kind, docker-credential-acr-env, secrets-store-csi-driver, dynamic-localpv-provisioner, bom, wait-for-port, pguser, sonobuoy, kustomize,...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: cluster-api-gcp-controller, kubeflow, crane, helm-set-status, terraform-provider-kubernetes, timoni, runc, podinfo, maru, vault-env, mage, cargobump, vault-k8s, juicefs, smarter-device-manager, speedtest-go, pvc-autoresizer, k3d, delve, s5cmd, shfmt, wgcf,...