CVE-2025-10745

CVE-2025-10745 affects Banhammer – Monitor Site Traffic, Block Bad Users and Bots (WordPress) up to version 3.4.8. Root cause: a deterministically generated secret key (using md5 and base64_encode) stored in banhammer_secret_key enables unauthenticated bypass by appending a GET parameter banhamme...

CVE-2025-10745 Banhammer – Monitor Site Traffic, Block Bad Users and Bots <= 3.4.8 - Unauthenticated Protection Mechanism Bypass

The Banhammer – Monitor Site Traffic, Block Bad Users and Bots plugin for WordPress is vulnerable to Blocking Bypass in all versions up to, and including, 3.4.8. This is due to a site-wide “secret key” being deterministically generated from a constant character set using md5 and base64encode and...

CVE-2025-60251

Unitree Go2, G1, H1, and B2 devices through 2025-09-20 accept any handshake secret with the unitree substring...

CVE-2025-60251

Unitree Go2, G1, H1, and B2 devices (through 2025-09-20) accept any handshake secret containing the unitree substring, enabling unauthorized access and control. CVSSv3.1 base score 5.0 (Medium) with adjacent attack vector, high attack complexity, and no privileges required. The issue affects the ...

PT-2025-39487

Name of the Vulnerable Software and Affected Versions Banhammer – Monitor Site Traffic, Block Bad Users and Bots plugin for WordPress versions through 3.4.8 Description The Banhammer plugin for WordPress is susceptible to a blocking bypass. This occurs because a site-wide “secret key” is...

PT-2025-39471

Name of the Vulnerable Software and Affected Versions Unitree Go2, G1, H1, and B2 devices through September 20, 2025 Description The devices accept any handshake secret containing the substring 'unitree'. This allows unauthorized access and control of the devices. Recommendations Update devices t...

CVE-2025-48707

An issue was discovered in Stormshield Network Security SNS before 5.0.1. TPM authentication information could, in some HA use cases, be shared among administrators, which can cause secret sharing...

CVE-2025-48707

An issue was discovered in Stormshield Network Security SNS before 5.0.1. TPM authentication information could, in some HA use cases, be shared among administrators, which can cause secret sharing...

CVE-2025-20160

A vulnerability in the implementation of the TACACS+ protocol in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to view sensitive data or bypass authentication. This vulnerability exists because the system does not properly check whether the required...

podman: Podman kube play command may overwrite host files

There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the targ...

podman: Podman kube play command may overwrite host files

There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the targ...

Malicious code in @sev-ui-verse/ta-product-models (npm)

The package @sev-ui-verse/ta-product-models was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d564367018a2440087b92862c41a4f2acf9fe9faf7c76a896fcf93f35b88642d Any computer that has this package installed or running should be...

Malicious code in @dropbox-photo-viewer/electron-app (npm)

The package @dropbox-photo-viewer/electron-app was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0e60f8bd38264b681d07237c310d98471fc7bfc1b9ab2bfabf4258bf01a9ea9 Any computer that has this package installed or running should be...

MAL-2025-47549 Malicious code in checkout-sheet-kit-react-native (npm)

The package checkout-sheet-kit-react-native was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 54397e8e5f2da7ea785328f6913d946c6a1a7daaab2b703580781f80f4e19726 Any computer that has this package installed or running should be...

MAL-2025-47556 Malicious code in giffgaff-status (npm)

The package giffgaff-status was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bcde685cc836f4f80fa6ae182e03b2bd9bae41b818468a5bbde4e94cbd4443ff Any computer that has this package installed or running should be considered fully...

Malicious code in @sev-ui-verse/event-tracking (npm)

The package @sev-ui-verse/event-tracking was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 456d3a4ed1bb864eafcf6a65c30be392f9dc9ac1342ab0c1cd51cc463f11ff7f Any computer that has this package installed or running should be considere...

MAL-2025-47525 Malicious code in @laposte-okapi/okapi-developpeur-web (npm)

The package @laposte-okapi/okapi-developpeur-web was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8fcb0f9f61fe02913727ec56f5391d8c9f0e028d6696ab70d97e68222b7642ca Any computer that has this package installed or running should be...

MAL-2025-47524 Malicious code in @kahoot-frontend/builder-common (npm)

The package @kahoot-frontend/builder-common was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f53ccdf6a282cfb91d99e8cccd2eea71cc0e2af65b1838e33733b3b872cec92e Any computer that has this package installed or running should be...

Malicious code in postman-converters (npm)

The package postman-converters was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f892ed43c85774f667cf9303e6d7ca7d30763a23dc3c6bb4e2261954dfee9070 Any computer that has this package installed or running should be considered fully...

MAL-2025-47552 Malicious code in dotenvx-config (npm)

The package dotenvx-config was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b1b17bc0067221fd1c252545277d6c9462a5c5ef95cfcdf96f7e320699387861 Any computer that has this package installed or running should be considered fully...