Malicious code in query-less-loader-passport-rest (npm)

The package query-less-loader-passport-rest was found to contain malicious code...

Malicious code in xanthus-rest-package-rocket (npm)

The package xanthus-rest-package-rocket was found to contain malicious code...

MAL-2025-43901 Malicious code in cosmicsilence-nightwatch-wavefunction-rest (npm)

The package cosmicsilence-nightwatch-wavefunction-rest was found to contain malicious code...

MAL-2025-45822 Malicious code in rest-meteor-telesto-apollo (npm)

The package rest-meteor-telesto-apollo was found to contain malicious code...

Malicious code in regulus-elara-rest-triton (npm)

The package regulus-elara-rest-triton was found to contain malicious code...

Malicious code in rest-changelog-mini-css-extract-plugin-eslint-plugin (npm)

The package rest-changelog-mini-css-extract-plugin-eslint-plugin was found to contain malicious code...

Malicious code in rest-hugo-dactyl-kastra (npm)

The package rest-hugo-dactyl-kastra was found to contain malicious code...

MAL-2025-46662 Malicious code in xanthus-rest-package-rocket (npm)

The package xanthus-rest-package-rocket was found to contain malicious code...

MAL-2025-43521 Malicious code in asteroid-quito-child-process-rest (npm)

The package asteroid-quito-child-process-rest was found to contain malicious code...

MAL-2025-44284 Malicious code in flight-rest-successful (npm)

The package flight-rest-successful was found to contain malicious code...

CVE-2025-58459

Jenkins global-build-stats Plugin 322.v22f4db18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attackers with Overall/Read permission to enumerate graph IDs...

CVE-2025-55739

api is a module for FreePBX@, which is an open source GUI that controls and manages Asterisk© PBX. In versions lower than 15.0.13, 16.0.2 through 16.0.14, 17.0.1 and 17.0.2, there is an identical OAuth private key used across multiple systems that installed the same FreePBX RPM or DEB package. An...

CVE-2025-55739

api is a module for FreePBX@, which is an open source GUI that controls and manages Asterisk© PBX. In versions lower than 15.0.13, 16.0.2 through 16.0.14, 17.0.1 and 17.0.2, there is an identical OAuth private key used across multiple systems that installed the same FreePBX RPM or DEB package. An...

VulnCheck KEV: CVE-2025-29925

XWiki Platform is a generic wiki platform. Prior to 15.10.14, 16.4.6, and 16.10.0-rc-1, protected pages are listed when requesting the REST endpoints /rest/wikis/wikiName/pages even if the user doesn't have view rights on them. It's particularly true if the entire wiki is protected with "Prevent...

CVE-2025-8268

The AI Engine plugin for WordPress is vulnerable to unauthorized access and loss of data due to a missing capability check on the restlist and deletefiles functions in all versions up to, and including, 2.9.5. This makes it possible for unauthenticated attackers to list and delete files uploaded ...

CVE-2025-8268

The CVE-2025-8268 entry concerns the WordPress AI Engine plugin (versions up to 2.9.5) with a missing capability check in the rest_list and delete_files paths, enabling unauthenticated attackers to list and delete files uploaded by other users. Impact per sources: unauthorized access and data los...

Missing Authorization

Overview org.jenkins-ci.plugins:global-build-stats is a global-build-stats plugin Affected versions of this package are vulnerable to Missing Authorization via the REST API endpoints, which do not perform permission checks. An attacker can enumerate graph IDs by sending requests with only...

GHSA-GM8G-FH49-QQ6V Jenkins global-build-stats Plugin missing permission check can result in graph IDs being enumerated

Jenkins global-build-stats Plugin 322.v22f4db18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attackers with Overall/Read permission to enumerate graph IDs. This has been patched in version 347.v32aeb0493c4f...

CVE-2025-58459

Jenkins global-build-stats Plugin 322.v22f4db18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attackers with Overall/Read permission to enumerate graph IDs...

CVE-2025-58459

Jenkins global-build-stats Plugin 322.v22f4db18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attackers with Overall/Read permission to enumerate graph IDs...