Malicious code in mockup-plugin-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 558235acfe4f70dc63b4fc13a84d52053efc759496cd14e3be1174f7ae4ee3df Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47902 Malicious code in mockup-device-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d724d8a07d3f57cfb72aa477d20c02f9b470a7ce9bb8ce5e5cd2895cd50b15e2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47903 Malicious code in mockup-plugin-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 558235acfe4f70dc63b4fc13a84d52053efc759496cd14e3be1174f7ae4ee3df Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lovable-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 903b816cc2c837a614d951c1cbb34aa264a93001e84b0c642687025ed9793e64 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47887 Malicious code in lovable-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 903b816cc2c837a614d951c1cbb34aa264a93001e84b0c642687025ed9793e64 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview lovable-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

@plone/volto vulnerable to potential DoS by invoking specific URL by anonymous user

Impact When visiting a specific URL, an anonymous user could cause the NodeJS server part of Volto to quit with an error. Patches The problem has been patched and the patch has been backported to Volto major versions down until 16. It is advised to upgrade to the latest patch release of your...

Malicious code in vite-plugin-parse-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f0c3c9412f03ac4be0712f183133c219efac17d93edf28bf821d9dae53b7856e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: Multiple vulnerabilities in IBM Planning Analytics

Summary There are vulnerabilities in Open Source Software OSS components consumed by IBM Planning Analytics. Additionally, IBM Planning Analytics is vulnerable to Cross-site scripting. This Security Bulletin relates only to the direct usage of third-party components by IBM Planning Analytics...

Security Bulletin: IBM App Connect Enterprise is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') due to Node.js ( CVE-2025-27210 )

Summary IBM App Connect Enterprise is vulnerable to Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' due to Node.js . Vulnerability Details CVEID:CVE-2025-27210 DESCRIPTION: An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting...

CVE-2025-56572

The finance.js JavaScript library (version 4.1.0 ) is vulnerable to a Denial of Service (DoS) attack. The root cause is the allocation of resources without limits or throttling ; specifically, the seekZero() function lacks iteration limits, and the IRR() function fails to properly handle the dept...

Server-Side Request Forgery (SSRF)

Next.js is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to the improper use of the next function without explicitly passing the request object, which allows an attacker to exploit incorrectly forwarded user-supplied headers in self-hosted applications...

moment-timezone

This repository is an add-on for Moment.js, a JavaScript library for working with dates and times. It provides support for timezones, allowing users to easily work with dates and times in different timezones. The repository contains a variety of files, including a Gruntfile.js, which is used to...

Malicious code in vite-linting-js (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-47741 Malicious code in vite-linting-js (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2025-58653

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in JS Morisset JSM filegetcontents Shortcode wp-file-get-contents allows Stored XSS.This issue affects JSM filegetcontents Shortcode: from n/a through = 2.7.1...

CVE-2025-57353

The Runtime components of messageformat package for Node.js before 3.0.2 contain a prototype pollution vulnerability. Due to insufficient validation of nested message keys during the processing of message data, an attacker can manipulate the prototype chain of JavaScript objects by providing...

PT-2025-39317

Name of the Vulnerable Software and Affected Versions messageformat versions prior to 3.0.1 Description The Runtime components of the messageformat package for Node.js are susceptible to a prototype pollution issue. Insufficient validation of nested message keys during message data processing...

Web3.js 安全漏洞

Web3.js is a TypeScript implementation of the Ethernet JSON RPC API open-sourced by Web3 and related tools maintained by ChainSafe Systems. A security vulnerability exists in Web3.js versions 1.10.4 and earlier, which stems from prototype contamination in the attachToObject function and could lea...

Web3.js 安全漏洞

Web3.js is a TypeScript implementation of the Ethernet JSON RPC API open-sourced by Web3 and related tools maintained by ChainSafe Systems. A security vulnerability exists in Web3.js versions 1.10.4 and earlier, which stems from prototype contamination in the attachToObject function and could lea...