CVE-2025-66031 affecting package reaper for versions less than 3.1.1-21

CVE-2025-66031 affecting package reaper for versions less than 3.1.1-21. A patched version of the package is available...

CVE-2025-66030 affecting package reaper for versions less than 3.1.1-21

CVE-2025-66030 affecting package reaper for versions less than 3.1.1-21. A patched version of the package is available...

CVE-2025-12816 affecting package reaper for versions less than 3.1.1-21

CVE-2025-12816 affecting package reaper for versions less than 3.1.1-21. A patched version of the package is available...

CVE-2018-19827 affecting package reaper for versions less than 3.1.1-20

CVE-2018-19827 affecting package reaper for versions less than 3.1.1-20. A patched version of the package is available...

AZL-71131 CVE-2025-66030 affecting package reaper for versions less than 3.1.1-21

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be...

AZL-71134 CVE-2025-66031 affecting package reaper for versions less than 3.1.1-21

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This...

AZL-71125 CVE-2025-12816 affecting package reaper for versions less than 3.1.1-21

An interpretation-conflict CWE-436 vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions...

A week in security (October 20 – October 26)

Last week on Malwarebytes Labs: Is AI moving faster than its safety net? Thousands of online stores at risk as SessionReaper attacks spread Apple may have to open its walled garden to outside app stores Meta boosts scam protection on WhatsApp and Messenger Home Depot Halloween phish gives users a...

Over 250 Magento Stores Hit Overnight as Hackers Exploit New Adobe Commerce Flaw

E-commerce security company Sansec has warned that threat actors have begun to exploit a recently disclosed security vulnerability in Adobe Commerce and Magento Open Source platforms, with more than 250 attack attempts recorded against multiple stores over the past 24 hours. The vulnerability in...

Magento SessionReaper

This module exploits CVE-2025-54236 SessionReaper, a critical vulnerability in Magento/Adobe Commerce that allows unauthenticated remote code execution. The vulnerability stems from improper handling of nested deserialization in the payment method context, combined with an unauthenticated file...

EUVD-2018-1875

Malware in sbrugna...

GHSA-3P8M-J85Q-PGMJ vulnerabilities

Vulnerabilities for packages: akhq, logstash, flyway, cloudwatch-exporter, selenium, tez, neo4j, sonarqube, opensearch, cassandra-fips, kafka, grpc-java-fips, apache-hop-fips, trino, management-api-for-apache-cassandra-4.1, apache-activemq-artemis, celeborn, camunda-zeebe, docker-selenium, zipkin...

AZL-66570 CVE-2025-9288 affecting package reaper 3.1.1-22

Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11...

atjiu pybbs 6.0.0 - Cross Site Scripting (XSS)

/ Exploit Title : atjiu pybbs 6.0.0 - Cross Site Scripting XSS Exploit Author: Byte Reaper Vendor Homepage: https://github.com/atjiu/pybbs Tested on: Kali Linux CVE: CVE-2025-8550...

Exploit for CVE-2025-7766

CVE-2025-7766 PoC Exploit PoC for exploiting XML External Ent...

CVE-2025-48924 vulnerabilities

Vulnerabilities for packages: celeborn, flyway, nrjmx, jenkins, kserve-modelmesh, apache-activemq-artemis, maven-stage0, airflow, apache-nifi, confluent-kafka, nextflow, spark, logstash, management-api-for-apache-cassandra-5.0, dependency-track, apache-nifi-registry, apicurio-registry, thingsboar...

GHSA-J288-Q9X7-2F5V vulnerabilities

Vulnerabilities for packages: celeborn, flyway, nrjmx, jenkins, kserve-modelmesh, apache-activemq-artemis, maven-stage0, airflow, apache-nifi, confluent-kafka, nextflow, spark, logstash, management-api-for-apache-cassandra-5.0, dependency-track, apache-nifi-registry, apicurio-registry, thingsboar...

GHSA-J288-Q9X7-2F5V vulnerabilities

Vulnerabilities for packages: jenkins, akhq, commercial-elasticsearch, logstash, flyway, solr-fips, tritonserver-backend-vllm-cuda-12.9, neo4j, dependency-track, sonarqube, apache-tika, opensearch, maven-stage0, sonar-scanner-cli, zaproxy, cassandra-fips, kafka, apache-hop-fips, leiningen,...

CBL Mariner 2.0 Security Update: reaper (CVE-2025-48387)

The version of reaper installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-48387 advisory. - tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue...

CBL Mariner 2.0 Security Update: reaper (CVE-2024-6484)

The version of reaper installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-6484 advisory. - A vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting XSS attacks. The...