PT-2025-21190 · Unknown · Oembed Providers

Name of the Vulnerable Software and Affected Versions: oEmbed Providers versions 0.0.0 through 2.2.1 Description: The issue affects oEmbed Providers, allowing Cross-Site Scripting XSS due to improper neutralization of input during web page generation. Recommendations: For versions 0.0.0 through...

Drupal oEmbed Providers 跨站脚本漏洞

Drupal oEmbed Providers is a module plugin in the Drupal content management system from the Drupal community. A cross-site scripting vulnerability exists in Drupal oEmbed Providers versions prior to 2.2.2 that stems from improper input neutralization and could lead to a cross-site scripting attac...

Authentication Bypass by Primary Weakness

Overview Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness due to the improper handling of JWS signature verification. An attacker can bypass security checks and authenticate using a specially crafted JWS without valid credentials. Note: CVE-2025-4658 i...

Authentication Bypass by Primary Weakness

Overview Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness due to the improper handling of JWS signature verification. An attacker can gain unauthorized access by submitting a specially crafted JWS that bypasses the signature check. This is only...

DRUPAL-CONTRIB-2025-048

This module extends the core Media module and allows site creators to permit oEmbed providers in addition to YouTube and Vimeo, which are deemed trustworthy by the Drupal Security Team. The module doesn't sufficiently mark its administrative permission as restricted, creating the possibility for...

Drupal oEmbed Providers module < 2.2.2 - Unauthenticated Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS vulnerability discovered by Pierre Rudloff prudloff in WordPress Module oEmbed Providers versions 2.2.2...

New Cloud Vulnerability Data Shows Google Cloud Leads in Risk

New research shows Google Cloud and smaller providers have the highest cloud vulnerability rates as compared to AWS…...

April 22, 2025—KB5055629 (OS Builds 22621.5262 and 22631.5262) Preview

None None...

[SECURITY] Fedora 41 Update: rust-icu_provider_macros-1.5.0-1.fc41

Proc macros for ICU data providers...

[SECURITY] Fedora 40 Update: rust-icu_provider_macros-1.5.0-1.fc40

Proc macros for ICU data providers...

[SECURITY] Fedora 42 Update: rust-icu_provider_macros-1.5.0-1.fc42

Proc macros for ICU data providers...

acryl-datahub-airflow-plugin (>=0.10.5.2rc3 <=0.11.0rc1), aind-airflow-jobs (>=0.2.1 <=0.2.6) +22 more potentially affected by CVE-2025-30473 via apache-airflow-providers-common-sql (>=1.0.0 <=1.20.0)

apache-airflow-providers-common-sql PYPI version =1.0.0, =0.10.5.2rc3, =0.2.1, =0.11.0, =0.2.0, =0.0.1, =0.0.1, =0.3.1, =0.0.4, =0.0.1a0, =2.6.0, =1.0.0rc1, =0.0.36, =1.0.0rc1, =1.0.0, =2.5.1rc1 and more Source cves: CVE-2025-30473 Source advisory: SNYK:PYTHON-APACHEAIRFLOWPROVIDERSCOMMONSQL-9667...

acryl-datahub-airflow-plugin (>=0.10.5.2rc3 <=0.11.0rc1), aind-airflow-jobs (>=0.2.1 <=0.2.6) +22 more potentially affected by CVE-2025-30473 via apache-airflow-providers-common-sql (>=1.0.0 <=1.20.0)

apache-airflow-providers-common-sql PYPI version =1.0.0, =0.10.5.2rc3, =0.2.1, =0.11.0, =0.2.0, =0.0.1, =0.0.1, =0.3.1, =0.0.4, =0.0.1a0, =2.6.0, =1.0.0rc1, =0.0.36, =1.0.0rc1, =1.0.0, =2.5.1rc1 and more Source cves: CVE-2025-30473 Source advisory: OSV:GHSA-5R62-MJF5-XWHJ...

PoisonSeed Exploits CRM Accounts to Launch Cryptocurrency Seed Phrase Poisoning Attacks

A malicious campaign dubbed PoisonSeed is leveraging compromised credentials associated with customer relationship management CRM tools and bulk email providers to send spam messages containing cryptocurrency seed phrases in an attempt to drain victims' digital wallets. "Recipients of the bulk sp...

SQL Injection

apacheairflowprovidersmysql is vulnerable to SQL Injection. The vulnerability is due to insufficient input validation and improper sanitization of user-supplied input in the dumpsql and loadsql functions, allowing attackers to inject and execute unintended SQL commands...

CVE-2025-30204 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, spire-server-fips, jitsucom-bulker, mc-fips, chezmoi, minio-fips, cilium-fips, oauth2-proxy, sigstore-scaffolding-fips, gomplate-fips, grafana, opentelemetry-collector-contrib-fips, step, terraform-provider-azapi-fips, kuma, trufflehog,...

Why Continuous Compliance Monitoring Is Essential For IT Managed Service Providers

Regulatory compliance is no longer just a concern for large enterprises. Small and mid-sized businesses SMBs are increasingly subject to strict data protection and security regulations, such as HIPAA, PCI-DSS, CMMC, GDPR, and the FTC Safeguards Rule. However, many SMBs struggle to maintain...

Malicious code in @theoretical123/providers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e1ac0be55c85d10a80061be96a98fee35155a4a24297d95b281f4ce8226b42a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Overview Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere due to the improper validation of target registry domains during the token exchange process. An attacker can extract and misuse authentication tokens by directin...

Citrix - CSP Monthly Consumption licenses EOL

On 01-Mar-2025, Citrix Service Providers running License Server v11.17.2 build 51000 with a combination of certain types of licenses were unable to launch end user sessions. The impacted licenses were associated with a discontinued licensing offering. There were some cases where partners on the n...