Use After Free

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Use After Free via MediaStreamTrackImpl. An attacker can cause heap corruption by enticing a user to visit a specially...

Information Exposure

Overview @finos/git-proxy is a Deploy custom push protections and policies on top of Git. Affected versions of this package are vulnerable to Information Exposure due to a lack of checking for hidden commits. An attacker can access sensitive repository data by injecting additional commits that ar...

Incorrect Authorization

Overview @finos/git-proxy is a Deploy custom push protections and policies on top of Git. Affected versions of this package are vulnerable to Incorrect Authorization via the push parser action process. An attacker can introduce unauthorized changes to remote repositories by bypassing required...

Security Bulletin: The IBM® Engineering Lifecycle Management products using WebSphere Application Server traditional is affected by arbitrary code execution (CVE-2025-36038)

Summary WebSphere Application Server traditional could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of serialized objects. Following IBM® Engineering Lifecycle Management product is vulnerable to this attack, it has been addressed in this...

PT-2025-93: Local Privilege Escalation in RemotePC

The vulnerability was identified in RemotePC, version 7.7.38. The discovered vulnerability allows an attacker to escalate privileges from a normal user to root. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 30.07.2025 Recommendations: Update to version 7.7.38 or...

Security Bulletin: IBM Engineering Requirements Management DOORS/DWA vulnerabilities addressed in 9.7.2.10

Summary Apache Portable Runtime, Dojo, CKEditor, DOORS and DOORS Web Access Libraries are identified as vulnerable components with multiple reported vulnerabilities. The IBM Engineering Requirements Management DOORS/DWA product version 9.7.2.9 is vulnerable to the below mentioned CVEs. Remediatio...

Security Bulletin: IBM Storage Ceph is vulnerable to Authorization Bypass in Grafana (CVE-2024-1313)

Summary Grafana is used by IBM Storage Ceph as a metrics dashboard. This bulletin identifies the steps to take to address the vulnerability in Grafana. CVE-2024-1313 Vulnerability Details CVEID:CVE-2024-1313 DESCRIPTION: It is possible for a user in a different organization from the owner of a...

Security Bulletin: IBM Storage Ceph is vulnerable to Cross-Site Request Forgery in Grafana (CVE-2023-45857)

Summary Grafana is used by IBM Storage Ceph as a metrics dashboard. This bulletin identifies the steps to take to address the vulnerability in Grafana. CVE-2023-45857 Vulnerability Details CVEID:CVE-2023-45857 DESCRIPTION: An issue discovered in Axios 1.5.1 inadvertently reveals the confidential...

Security Bulletin: IBM Storage Ceph is vulnerable to CSRF in Grafana (CVE-2023-45857)

Summary Grafana is used by IBM Storage Ceph as a metrics dashboard. This bulletin identifies the steps to take to address the vulnerability in Grafana. CVE-2023-45857 Vulnerability Details CVEID:CVE-2023-45857 DESCRIPTION: An issue discovered in Axios 1.5.1 inadvertently reveals the confidential...

Security Bulletin: IBM Storage Ceph is vulnerable to Prototype Pollution in ToughCookie via Grafana (CVE-2023-26136)

Summary Grafana is used by IBM Storage Ceph as a metrics dashboard. This bulletin identifies the steps to take to address the vulnerability in Grafana. CVE-2023-26136 Vulnerability Details CVEID:CVE-2023-26136 DESCRIPTION: Versions of the package tough-cookie before 4.1.3 are vulnerable to...

Security Bulletin: IBM Storage Ceph is vulnerable to Insufficient Verification of Data Authenticity in Moby via Grafana (CVE-2024-24557)

Summary Grafana is used by IBM Storage Ceph as a metrics dashboard. This bulletin identifies the steps to take to address the vulnerability in IBM Storage Ceph. CVE-2024-24557 Vulnerability Details CVEID:CVE-2024-24557 DESCRIPTION: Moby is an open-source project created by Docker to enable softwa...

Security Bulletin: IBM InfoSphere Information Server is vulnerable to sensitive information disclosure (CVE-2025-25045)

Summary A sensitive information disclosure vulnerability in IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2025-25045 DESCRIPTION: IBM InfoSphere Information Server authenticated user to obtain sensitive information when a detailed technical error message is...

Security Bulletin: IBM Cloud Pak System is vulnerable to an authenticated command-execution due to use of VMWare vCenter [CVE-2025-41225].

Summary IBM Cloud Pak System is vulnerable to an authenticated command-execution due to use of VMware vCenter CVE-2025-41225. Vulnerability Details CVEID:CVE-2025-41225 DESCRIPTION: The vCenter Server contains an authenticated command-execution vulnerability. A malicious actor with privileges to...

📄 Xorux LPAR2RRD 8.04 Information Disclosure

Xorux LPAR2RRD versions 8.04 and below have an API endpoint that should be limited to web application administrators. It is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to download logs from the appliance configuration, exposing sensitive...

Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM WebSphere Hybrid Edition, is affected by a security bypass vulnerability (CVE-2024-56339)

Summary IBM WebSphere Application Server, which is bundled with IBM WebSphere Hybrid Edition, is affected by a security bypass caused by a failure to honor security configuration. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and...

Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is affected by a security bypass vulnerability (CVE-2024-56339)

Summary IBM Webphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is affected by a security bypass caused by a failure to honor security configuration. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Product...

Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is affected by a security bypass vulnerability (CVE-2024-56339)

Summary IBM Webphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is affected by a security bypass caused by a failure to honor security configuration. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected...

Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is affected by a security bypass vulnerability (CVE-2024-56339)

Summary IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is affected by a security bypass caused by a failure to honor security configuration. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and...

Security Bulletin: Vulnerability in jackson-core affects IBM Cloud Pak System[CVE-2025-52999]

Summary Vulnerability found for potential stackoverflowError in jackson-core affects IBM Cloud Pak System. Vulnerability was addressed by IBM Cloud Pak System. Vulnerability Details CVEID:CVE-2025-52999 DESCRIPTION: jackson-core contains core low-level incremental "streaming" parser and generator...

Malicious Package

Overview openai-fm is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...