auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import

Overview In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected? You are affected by this vulnerability if you meet the...

CVE-2025-23297

CVE-2025-23297 concerns NVIDIA App on Windows. The issue is in the FrameviewSDK installation process within the NVIDIA Installer for NvAPP for Windows, where a local unprivileged attacker could modify files in the Frameview SDK directory, potentially leading to privilege escalation. Documents con...

PT-2025-40302

Name of the Vulnerable Software and Affected Versions NVIDIA Installer for NvAPP for Windows affected versions not specified Description The NVIDIA Installer for NvAPP for Windows has a flaw in the FrameviewSDK installation process. An attacker with local unprivileged access can alter files withi...

NVIDIA App 安全漏洞

NVIDIA App is a client software from NVIDIA Corporation USA. A security vulnerability exists in NVIDIA App that stems from a file that can be modified during the FrameviewSDK installation process, which could result in elevated privileges...

Razer Synapse 3 Chroma Connect Link Following Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Razer Synapse 3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Razer Chroma SDK...

MinIO Java SDK 代码注入漏洞

MinIO Java SDK is an open source developer tool for MinIO Client for Java by MinIO. A code injection vulnerability exists in versions of MinIO Java SDK prior to 8.6.0, which stems from the automatic substitution of XML tagged values for system properties or environment variables, which could lead...

CVE-2025-59952

CVE-2025-59952 is a vulnerability in the MinIO Java SDK (minio-java). In versions prior to 8.6.0, XML tag values containing references to system properties or environment variables were substituted with their actual values during processing, potentially exposing sensitive information (credentials...

CVE-2025-59952 minio-java Client XML Tag is Vulnerable to Value Substitution

MinIO Java SDK is a Simple Storage Service aka S3 client to perform bucket and object operations to any Amazon S3 compatible object storage service. In minio-java versions prior to 8.6.0, XML tag values containing references to system properties or environment variables were automatically...

CVE-2025-59952 minio-java Client XML Tag is Vulnerable to Value Substitution

MinIO Java SDK is a Simple Storage Service aka S3 client to perform bucket and object operations to any Amazon S3 compatible object storage service. In minio-java versions prior to 8.6.0, XML tag values containing references to system properties or environment variables were automatically...

CVE-2025-59952 minio-java Client XML Tag is Vulnerable to Value Substitution

MinIO Java SDK is a Simple Storage Service aka S3 client to perform bucket and object operations to any Amazon S3 compatible object storage service. In minio-java versions prior to 8.6.0, XML tag values containing references to system properties or environment variables were automatically...

PT-2025-39921

Name of the Vulnerable Software and Affected Versions MinIO Java SDK versions prior to 8.6.0 Description The MinIO Java SDK is a client for performing bucket and object operations with Amazon S3 compatible object storage services. Versions prior to 8.6.0 improperly handle XML tag values containin...

Malicious code in synthetics-sdk-broken-links (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-47730 Malicious code in synthetics-sdk-broken-links (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in @vietnetco-distribution/internal-sdk (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in @discord-external/activity-iframe-sdk (npm)

The package @discord-external/activity-iframe-sdk was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: google-open-source-security c4df7af2ceae80fdc052edf95094a378287786ae21cfec9a6104a2af2b1d9b98 This package installs a dependency hosted on a cust...

Malicious Package

Overview com.venly.sdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2025-59430

Mesh Connect JS SDK contains JS libraries for integrating with Mesh Connect. Prior to version 3.3.2, the lack of sanitization of URLs protocols in the createLink.openLink function enables the execution of arbitrary JavaScript code within the context of the parent page. This is technically...

ai-sdk-provider-claude-code (>=0.2.0, <=1.0.0-beta.1), locadex (0.0.2-alpha.1) potentially affected by CVE-2025-59828 via @anthropic-ai/claude-code (>=1.0.8, <=1.0.24)

@anthropic-ai/claude-code NPM version =1.0.8, =0.2.0, =1.0.0-beta.1 - locadex 0.0.2-alpha.1 Source cves: CVE-2025-59828 Source advisory: OSV:GHSA-2JJV-QF24-VFM4...

@dwimm/client-web (>=0.0.1, <=0.0.2-86), @element-hq/web-shared-components (>=0.0.0-test.6, <=0.1.2) +26 more potentially affected by CVE-2025-57354 via counterpart (>=0.16.10, <=0.18.6)

counterpart NPM version =0.16.10, =0.0.1, =0.0.0-test.6, =1.0.0-alpha, =2.10.1, =0.0.1, =0.7.1, =0.0.1, =0.1.8, =2.3.0-rc.1, =3.114.0 and more Source cves: CVE-2025-57354 Source advisory: OSV:GHSA-2488-W585-72CH...

CVE-2025-57324

The CVE-2025-57324 entry concerns the Parse-SDK-JS library. A prototype pollution flaw exists in SingleInstanceStateController.initializeState, allowing a crafted payload to inject properties into Object.prototype. Affected versions are parse 5.3.0 and earlier. Consequences include denial of serv...