MAL-2025-44060 Malicious code in dotenv-safe-sedna-procyon-halley (npm)

The package dotenv-safe-sedna-procyon-halley was found to contain malicious code...

MAL-2025-44061 Malicious code in dotenv-safe-whitedwarf-castor-magnetar (npm)

The package dotenv-safe-whitedwarf-castor-magnetar was found to contain malicious code...

MAL-2025-45092 Malicious code in magnetosphere-dotenv-safe-optimize-css-assets-webpack-plugin-mineralogy (npm)

The package magnetosphere-dotenv-safe-optimize-css-assets-webpack-plugin-mineralogy was found to contain malicious code...

CVE-2025-9824

ImpactThe attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could attempt brute force attacks. PatchesThis vulnerability has been patched, implementing a timing-safe form login...

CVE-2025-48546

In checkPermissions of SafeActivityOptions.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48546

In checkPermissions of SafeActivityOptions.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48546

A logic error in the checkPermissions function of the SafeActivityOptions.java module within the Android operating system allows for a possible background activity launch . This vulnerability could lead to a local escalation of privilege without requiring additional execution privileges or user i...

UBUNTU-CVE-2025-38703

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Make dma-fences compliant with the safe access rules Xe can free some of the data pointed to by the dma-fences it exports. Most notably the timeline name can get freed if userspace closes the associated submit queue. At t...

Keras safe_mode bypass allows arbitrary code execution when loading a malicious model.

...

PT-2025-36067

Name of the Vulnerable Software and Affected Versions: SafeActivityOptions.java affected versions not specified Description: A logic error in the checkPermissions function of SafeActivityOptions.java may allow for the launch of background activities. This could lead to local escalation of privile...

GHSA-MW26-5G2V-HQW3 DeepDiff Class Pollution in Delta class leading to DoS, Remote Code Execution, and more

Summary Python class pollution is a novel vulnerability categorized under CWE-915. The Delta class is vulnerable to class pollution via its constructor, and when combined with a gadget available in DeltaDiff itself, it can lead to Denial of Service and Remote Code Execution via insecure Pickle...

Mautic Vulnerable to User Enumeration via Response Timing

Impact The attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could attempt brute force attacks. Patches This vulnerability has been patched, implementing a timing-safe form login...

GHSA-3GGV-QWCP-J6XG Mautic Vulnerable to User Enumeration via Response Timing

Impact The attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could attempt brute force attacks. Patches This vulnerability has been patched, implementing a timing-safe form login...

CVE-2025-9824

ImpactThe attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could attempt brute force attacks. PatchesThis vulnerability has been patched, implementing a timing-safe form login...

CVE-2025-9824 User Enumeration via Response Timing

ImpactThe attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could attempt brute force attacks. PatchesThis vulnerability has been patched, implementing a timing-safe form login...

CVE-2025-9824

The CVE-2025-9824 issue stems from different login response times for existing versus non-existent users in Mautic, enabling user enumeration and potential brute-force attempts. Technical details describe that valid usernames trigger password hashing while invalid ones do not; the fix adds a Timi...

CVE-2025-9824 User Enumeration via Response Timing

ImpactThe attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could attempt brute force attacks. PatchesThis vulnerability has been patched, implementing a timing-safe form login...

CVE-2025-9824 User Enumeration via Response Timing

ImpactThe attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could attempt brute force attacks. PatchesThis vulnerability has been patched, implementing a timing-safe form login...

PT-2025-35774

Name of the Vulnerable Software and Affected Versions: versions prior to the patched version Description: The attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could attempt brute for...

MobSF Path Traversal in GET /download/<filename> using absolute filenames

Summary The GET /download/ route uses string path verification via os.path.commonprefix, which allows an authenticated user to download files outside the DWDDIR download directory from "neighboring" directories whose absolute paths begin with the same prefix as DWDDIR e.g., .../downloadsbak,...