BELL-CVE-2025-38353

Bulletin has no description...

BELL-CVE-2025-38459

Bulletin has no description...

MAL-2025-6258 Malicious code in redux-saga-task-cancel-rce (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c07b2373aad3c184230b7a8e110bcbfcbe8bb7620815c9099e44d13d05f06bfb Any computer that has this package installed or running should be considered...

MAL-2025-6250 Malicious code in @grafanacloud/plugins-platform-backend (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis eb7ac91dd5a55c67e31e4875b9f32f5a8778e2d25e69dc79e81d418356990fa8 The OpenSSF Package Analysis project identified...

CVE-2025-54385

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions between 17.0.0-rc1 to 17.2.2 and versions 16.10.5 and below, it's possible to execute any SQL query in Oracle by using the function like DBMSXMLGEN or DBMSXMLQUERY. The...

CVE-2025-50184 DbGate allows for File Traversal via file parameter

DbGate is cross-platform database manager. In versions 6.4.3-premium-beta.5 and below, DbGate is vulnerable to a directory traversal flaw. The file parameter is not properly restricted to the intended uploads directory. As a result, the endpoint that lists files within the upload directory can be...

Linkify Allows Prototype Pollution & HTML Attribute Injection (XSS)

Prototype Pollution in internal assign helper in Linkify allows remote attackers to execute arbitrary JavaScript Stored or Reflected XSS via injection of event handlers through unfiltered proto property. This issue affects Linkify version 4.3.1 and is fixed in 4.3.2...

MAL-2025-6284 Malicious code in events-web (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 11bce84a2df0c77a986a5222ee63a711826ee5df30aa4791cf3e969c0bee7e8b Any computer that has this package installed or running should be considered...

GHSA-49JM-G4M8-X53P Withdrawn Advisory: CodeIgniter4 Cross-Site Scripting Vulnerability in debugbar_time Parameter

Withdrawn Advisory This advisory has been withdrawn because the original report was found to be invalid. This link is maintained to preserve external references. For more information, see https://github.com/github/advisory-database/pull/5862. Original Description A stored cross-site scripting XSS...

Malicious code in budoux-extension (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b648f8e2f3161c2d499b10cce27dfd7bc034fc56857168b74c85c0dd29d03fe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CGA-584C-R2V4-MCG5

Bulletin has no description...

CVE-2025-38362 drm/amd/display: Add null pointer check for get_first_active_display()

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add null pointer check for getfirstactivedisplay The function modhdcphdcp1enableencryption calls the function getfirstactivedisplay, but does not check its return value. The return value is a null pointer if the...

CGA-R4XM-6697-XWJP

Bulletin has no description...

CGA-7WC2-HGJX-9F23

Bulletin has no description...

CGA-5MH8-6MHM-C4M4

Bulletin has no description...

Cross-site Scripting (XSS)

Cadwyn is vulnerable to Reflected Cross-Site Scripting XSS. The vulnerability is due to improper handling of the version parameter in the /docs endpoint, which allows an attacker to execute arbitrary JavaScript in a user's session via a one-click attack...

Improper Authentication

github.com/mattermost/mattermost-server is vulnerable to improper authentication. The vulnerability is due to the failure to negotiate a new token when accepting an invite, which allows an attacker who intercepts both the invite and password to send synchronization payloads to the original server...

WordPress Educenter Theme <= 1.6.2 is vulnerable to Cross Site Scripting (XSS)

Software Educenter Type Theme Vulnerable versions = 1.6.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2025-5529 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8465b696cfd2 Credits Peter Thaleikis Required privileg...

CVE-2025-54379 eKuiper API endpoints handling SQL queries with user-controlled table names.

LF Edge eKuiper is a lightweight IoT data analytics and stream processing engine running on resource-constraint edge devices. In versions before 2.2.1, there is a critical SQL Injection vulnerability in the getLast API functionality of the eKuiper project. This flaw allows unauthenticated remote...

CVE-2025-7404 Calibre Web 0.6.24 & Autocaliweb 0.7.0 - Blind C

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Calibre Web, Autocaliweb allows Blind OS Command Injection.This issue affects Calibre Web: 0.6.24 Nicolette; Autocaliweb: from 0.7.0 before 0.7.1...