13087 matches found
MAL-2025-6679 Malicious code in xo-angular-ui-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 17c1ba74b83fb3a51e171948d55aa626342a1477d24f1f0f768f093cba5feef7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CGA-FVH6-H8CG-6G9F
Bulletin has no description...
MINI-GVQM-H5M6-8WP2
Bulletin has no description...
MINI-4H2R-8VQR-96QF
Bulletin has no description...
CVE-2025-6076
Partner Software's Partner Software application and Partner Web application do not sanitize files uploaded on the "reports" tab, allowing an authenticated attacker to upload a malicious file and compromise the device. By default, the software runs as SYSTEM, heightening the severity of the...
OSV-2025-591 UNKNOWN READ in mov_read_header
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=435536867 Crash type: UNKNOWN READ Crash state: movreadheader avformatopeninput demuxopenlavf...
CGA-37JM-96VQ-HP7G
Bulletin has no description...
GHSA-6H4P-M86H-HHGH Hashicorp Vault has Privilege Escalation Vulnerability
A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s token privileges to Vault’s root policy. Fixed in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11 and 1.16.22...
MAL-2025-6732 Malicious code in internal-random (npm)
The package communicates with a domain associated with malicious activity...
CVE-2025-54593 FreshRSS is vulnerable to RCE attacks by authenticated admin
FreshRSS is a free, self-hostable RSS aggregator. In versions 1.26.1 and below, an authenticated administrator user can execute arbitrary code on the FreshRSS server by modifying the update URL to one they control, and gain code execution after running an update. After successfully executing code...
CVE-2025-53011 MaterialX is Vulnerable to NULL Pointer Dereference due to Unchecked implGraphOutput
MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In version 1.39.2, when parsing shader nodes in a MTLX file, the MaterialXCore code accesses a potentially null pointer, which can lead to crashes with maliciously craft...
CVE-2025-45767
jose v6.0.10 was discovered to contain weak encryption. NOTE: this is disputed by a third party because the claim of "do not meet recommended security standards" does not reflect guidance in a final publication...
MINI-MWF4-QFWX-7GH4
Bulletin has no description...
CVE-2025-8454
It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts a collection of scripts to make the life of a Debian Package maintainer easier, skips OpenPGP verification if the upstream source is already downloaded from a previous run even...
MINI-H56G-QVC7-P385
Bulletin has no description...
MAL-2025-6724 Malicious code in goals-summary-widget (npm)
The package communicates with a domain associated with malicious activity...
MAL-2025-6783 Malicious code in web3-plugin-swisstronik (npm)
The package communicates with a domain associated with malicious activity...
ASB-A-407994187
Bulletin has no description...
WordPress Sina Extension for Elementor plugin <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Sina Posts`, `Sina Blog Post` and `Sina Table` Widgets vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via Sina Posts, Sina Blog Post and Sina Table Widgets vulnerability discovered by stealthcopter in WordPress Plugin Sina Extension for Elementor versions = 3.7.0...