NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference via the MSL parser when processing a tag before any image is loaded. An attacker can cause a crash and denial of service by submitting a specially crafted MSL file that triggers a NULL pointer dereference during...

NULL Pointer Dereference

Overview Magick.NET-Q8-OpenMP-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package ar...

NULL Pointer Dereference

Overview Magick.NET-Q16-AnyCPU is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the createDocWithMd function, where unsanitized input in the markdown parameter is passed to downstream processing functions. An attacker can access arbitrary files on the server or interact with...

Security Bulletin: This Power System update is being released to address CVE-2025-49133

Summary The PowerVM Virtual Trusted Platform Module vTPM feature is impacted by the referenced vulnerability. This issue was fixed in a previous security bulletin for CVE-2025-2884: https://www.ibm.com/support/pages/node/7238453 Vulnerability Details CVEID:CVE-2025-49133 DESCRIPTION: Libtpms is a...

Improper Neutralization of Special Elements Used in a Template Engine

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine when processing untrusted template expressions. An attacker can execute arbitrary code on the server by injecting specially crafted template payloads. Remediation...

From Detection to Remediation: Wiz in Your JetBrains IDE

The Wiz JetBrains IDE plugin is now generally available, enabling developers to fix risks before code leaves their local environment...

Infinite loop

Overview Magick.NET-Q16-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Eval Injection

Overview Affected versions of this package are vulnerable to Eval Injection via the resourceurlproxy function. An attacker can execute arbitrary system commands by supplying crafted input to the enginename attribute, which is evaluated within the application context. PoC require 'ostruct' def...

Authentication Bypass by Spoofing

Overview Affected versions of this package are vulnerable to Authentication Bypass by Spoofing in the externaloauth2token middleware. An attacker can gain unauthorized access or escalate privileges by sending forged authentication headers such as X-Is-Admin-Project, X-Roles, or X-User-Id...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses golang.org/x/crypto which is vulnerable to CVE-2025-47913

Summary IBM Maximo Application Suite - Visual Inspection component uses golang.org/x/crypto which is vulnerable to CVE-2025-47913. This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2025-47913 DESCRIPTION: SSH clients receiving...

Malicious code in wac-react-relay (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e6230f7070c6a961274bcbd24ce695e9079873b97e2a34d1548f39451925cb2 The package wac-react-relay was found to contain malicious code. Source: ghsa-malware 8e4689baba605d11cb3859f852360989942c364318df4e05fc6d1265ff31061...

PT-2026-3476

Name of the Vulnerable Software and Affected Versions HotCRP version 3.1 Description HotCRP is conference review software. A flaw introduced in April 2024 in version 3.1 allows users to trigger the execution of arbitrary PHP code due to inadequately sanitized code generation for HotCRP formulas...

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the GenImageFontAtlas function. An attacker can execute arbitrary code or cause a denial of service by providing specially crafted input that triggers a heap-based buffer overflow during local execution...

Exploit for Path Traversal in Openbsd Openssh

Bastion AI-Powered Penetration Testing Platform for macOS...

Security Bulletin: A vulnerability in grpc affects IBM Robotic Process Automation and may result in unexpected results (CVE-2025-47907).

Summary A vulnerability in grpc affects IBM Robotic Process Automation and may result in unexpected results CVE-2025-47907. grpc is used by IBM Robotic Process Automation as part of Watson NLP. This bulletin identifies the fixes required to address this vulnerability. Vulnerability Details...

Malicious Package

Overview experian-design-system is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview chakra-ui-2--theme-tools is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview tailwind-merge-v3 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview lead-ion is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...