CVE-2025-62374: Improperly Controlled Modification of Object Prototype Attributes

Parse Javascript SDK provides access to the powerful Parse Server backend from your JavaScript app. Prior to 7.0.0, injection of malicious payload allows attacker to remotely execute arbitrary code. ParseObject.fromJSON, ParseObject.pin, ParseObject.registerSubclass, ObjectStateMutations internal...

PT-2025-42196

Name of the Vulnerable Software and Affected Versions Parse Javascript SDK versions prior to 7.0.0 Description A flaw exists in Parse Javascript SDK that, before version 7.0.0, allows for remote code execution through the injection of malicious payloads. The following components are impacted:...

EUVD-2021-1944

Malware in sbrugna...

EUVD-2022-6927

Malicious code in bioql PyPI...

EUVD-2024-2665

Malicious code in bioql PyPI...

EUVD-2023-3320

Malicious code in bioql PyPI...

EUVD-2023-1517

Malicious code in bioql PyPI...

EUVD-2025-29628

Malicious code in bioql PyPI...

EUVD-2022-6842

Malicious code in bioql PyPI...

EUVD-2024-1160

Malicious code in bioql PyPI...

EUVD-2024-3188

Malicious code in bioql PyPI...

EUVD-2023-0812

Malicious code in bioql PyPI...

EUVD-2024-2111

Malicious code in bioql PyPI...

EUVD-2023-1061

Malicious code in bioql PyPI...

EUVD-2022-6714

Malicious code in bioql PyPI...

EUVD-2022-6713

Malicious code in bioql PyPI...

CVE-2025-57324

The parse JavaScript SDK package is vulnerable to a Prototype Pollution vulnerability in the SingleInstanceStateController.initializeState function (affected versions 5.3.0 and before ). An attacker can supply a crafted payload, such as specifying a className value of proto, to inject malicious p...

Mesh Connect JS SDK Vulnerable to Cross Site Scripting via createLink.openLink

Summary The lack of sanitization of URLs protocols in the createLink.openLink function enables the execution of arbitrary JavaScript code within the context of the parent page. Details...

CVE-2025-59430

Mesh Connect JS SDK contains a cross-site scripting (XSS) vulnerability in the web-link component. Prior to version 3.3.2, createLink.openLink does not sanitize the URL protocol, allowing an attacker-controlled base64-encoded payload to set an iframe src that executes arbitrary JavaScript in the ...

Linux Distros Unpatched Vulnerability : CVE-2025-59160

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Matrix JavaScript SDK is a Matrix Client-Server SDK for JavaScript and TypeScript. matrix-js-sdk before 38.2.0 has insufficient validation of room predecessor...