PT-2025-47728

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'eh crm remove agent' function in all versions up to, and including, 3.3.1. This makes it possible for authenticated attackers,...

WordPress plugin ELEX WordPress HelpDesk & Customer Ticketing System 安全漏洞

WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin is a helpdesk and customer work order system plugin for WordPress websites designed to help businesses or individuals efficiently manage customer support requests. WordPress ELEX WordPress HelpDesk & Customer Ticketing System...

CLSA-2025-1763651916 xorg-x11-server-Xwayland: Fix of 4 CVEs

CVE-2023-1393: fix use-after-free in compositor overlay window by clearing dangling COW pointer - CVE-2024-31080: prevent heap over-read in ProcXIGetSelectedEvents caused by using byte-swapped length values in replies. - CVE-2024-31081: fix buffer over-read in ProcXIPassiveGrabDevice by using...

Malicious Package

Overview com.unity.polyspatial is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview node-calculator-fa00 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview node-calculator-x7k9 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

TencentOS Server 4: python-certifi (TSSA-2024:0273)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0273 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

TencentOS Server 4: kernel (TSSA-2025:0047)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0047 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

Malicious Package

Overview react-svg-module is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2025-190572 Malicious code in react-svg-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9b392459196e5602d6e40cd38445d10e87e49d85b53b966aee554dd758fc1bd The package react-svg-module was found to contain malicious code. Source: ghsa-malware dd046bd4ddd4da53330303e0802201fda828bce7e1a21524aa7fc0da1fed95...

Oracle Linux 7 : squid (ELSA-2025-19167)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-19167 advisory. - Fixes CVE-2025-62168, squid: Squid vulnerable to information disclosure via - Fixes CVE-2025-54574, add URN access disabling config options Orabug: 38350105 ...

AlmaLinux 9 : xorg-x11-server (ALSA-2025:20961)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:20961 advisory. xorg: xmayland: Use-after-free in XPresentNotify structure creation CVE-2025-62229 xorg: xwayland: Use-after-free in Xkb client resource removal...

Vulnerabilities fixed in GitLab

GitLab has fixed vulnerabilities in GitLab CE/EE versions for 18.3.6, 18.4.4, and 18.5.2. The vulnerabilities include the ability for attackers to remove Duo authentication flows, access sensitive information via GraphQL subscriptions, and bypass access controls on GitLab Pages. These...

Malicious Package

Overview node-calculator-3e62 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2025-190562 Malicious code in node-calculator-3e62 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1703fc5c6d064d50b797ea676b0a02186a5cce75afc97191661b8aaa82624543 The package node-calculator-3e62 was found to contain malicious code. Source: ghsa-malware...

Malicious code in tailwindcss-breezium (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f92d0ba07d104ef809e0b5b17fe93670e80af4cceecde2f9afb14f8357febcdc The package tailwindcss-breezium was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190557 Malicious code in @grumpycoffeecup/hello-npm-world (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a093b0e1fa1064f7696cf7ea0b583ffaf5470026f8c5da1613204168b33b09ed The package @grumpycoffeecup/hello-npm-world was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview mongoose-odm is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview workingstealer is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in 1libxmljs2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aabdd956b939ba7ecadbced1795cced1214b25b2faf5920d3dd1f80374b42390 The package 1libxmljs2 was found to contain malicious code. Source: ghsa-malware f356ae30a62d4d1611f89041412c4c86aadd5c438b5809c1d4ee201ee814ea26 Any...