MAL-2025-2665 Malicious code in discourse-web3auth-theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 22290c7662af2d58b4706977dcf0e780e9aa9f028a6d15d75e47831ab96362f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-12723 · H3C · H3C Magic Be18000 +4

Name of the Vulnerable Software and Affected Versions: H3C Magic NX15 versions up to V100R014 H3C Magic NX30 Pro versions up to V100R014 H3C Magic NX400 versions up to V100R014 H3C Magic R3010 versions up to V100R014 H3C Magic BE18000 versions up to V100R014 Description: A critical issue affects...

PT-2025-12806 · Glpi +1 · Glpi Inventory Plugin +1

Name of the Vulnerable Software and Affected Versions: GLPI Inventory Plugin versions prior to 1.5.0 Description: The GLPI Inventory Plugin handles various tasks for GLPI agents, including network discovery and inventory, software deployment, and data collection. It has an improper access control...

Luxion KeyShot security vulnerability

Luxion KeyShot is a software for designing photos of 3D scenes from Luxion, USA. The software allows real-time 3D rendering workflows to display results immediately and reduce the time required to create photorealistic product photos. A security vulnerability exists in Luxion KeyShot that stems...

Spring Security Vulnerable to Authorization Bypass via Security Annotations

Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. This may cause an authorization bypass. You are not affected if you are not using @EnableMethodSecurity, or you do not have method security annotations on parameterized types or...

CVE-2025-30570

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in AliRezaMohammadi دکمه، شبکه اجتماعی خرید dokme allows SQL Injection.This issue affects دکمه، شبکه اجتماعی خرید: from n/a through = 2.0.6...

CVE-2025-0835

A vulnerability exists in Imagination Technologies microprogramming software for PowerVR-GPU components, where a Use After Free (CWE-416) condition occurs. Specifically, the function _WrapExtMemReleasePages may be called twice if _FlushUMVirtualRange fails. A non-privileged user can exploit this ...

MAL-2025-3434 Malicious code in bbllaacckkwwoollff6ad8f753 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6d4b59c0779917e138aea3b1a424593ca84b58fa16a0cd75ba8a4c7523f92c87 During installation, the code either exfiltrate some information about the system or download and execute remote code --- Category: MALICIOUS - The campaign ha...

PT-2025-12667

Name of the Vulnerable Software and Affected Versions: Vite versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. Description: Vite is susceptible to an arbitrary file read vulnerability due to improper handling of special characters in the @fs mechanism. By appending ?raw?? or ?import&raw?...

PT-2025-12708 · Onos · Onos

Name of the Vulnerable Software and Affected Versions: onos version 2.7.0 Description: The issue is related to limited secret space in LLDP packets, which can be exploited by attackers to obtain the private key via a brute force attack. Attackers can leverage this to create crafted LLDP packets...

Delta Electronics CNCSoft-G2 Input Validation Error Vulnerability

Delta Electronics CNCSoft-G2 is a human-machine interface HMI software from Delta Electronics, China. An input validation error vulnerability exists in Delta Electronics CNCSoft-G2 version 2.1.0.16 and prior versions, which can be exploited by an attacker to execute code in the current process...

openSUSE Security Advisory (SUSE-SU-2025:0984-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-12494 · Unknown · Project Worlds Online Time Table Generator

Name of the Vulnerable Software and Affected Versions: Project Worlds Online Time Table Generator version 1.0 Description: A critical issue has been found, affecting an unknown function of the file student/studentdashboard.php. The manipulation of the course argument leads to SQL injection. This...

PT-2025-12493 · Unknown · Project Worlds Online Time Table Generator

Name of the Vulnerable Software and Affected Versions: Project Worlds Online Time Table Generator version 1.0 Description: A critical issue affects the processing of the file /staff/index.php. The manipulation of the argument e leads to sql injection. The attack may be initiated remotely. The...

CVE-2025-30472

Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orftokenendianconvert in exec/totemsrp.c via a large UDP packet...

PipeCD Vulnerable to Privilege Escalation

Insecure permissions in pipecd v0.49 allow attackers to gain access to the service account's token, leading to escalation of privileges...

CVE-2025-30157 Envoy crashes when HTTP ext_proc processes local replies

Envoy is a cloud-native high-performance edge/middle/service proxy. Prior to 1.33.1, 1.32.4, 1.31.6, and 1.30.10, Envoy's extproc HTTP filter is at risk of crashing if a local reply is sent to the external server due to the filter's life time issue. A known situation is the failure of a websocket...

CVE-2025-27612 Libcontainer is affected by capabilities elevation

libcontainer is a library for container control. Prior to libcontainer 0.5.3, while creating a tenant container, the tenant builder accepts a list of capabilities to be added in the spec of tenant container. The logic here adds the given capabilities to all capabilities of main container if prese...

GHSA-CW7Q-5CGC-H3H9 Mattermost fail to prompt for explicit approval before adding a team admin to a private channel

Mattermost versions 9.11.x = 9.11.8 fail to prompt for explicit approval before adding a team admin to a private channel, which team admins to joining private channels via crafted permalink links without explicit consent from them...

Mattermost fail to prompt for explicit approval before adding a team admin to a private channel

Mattermost versions 9.11.x = 9.11.8 fail to prompt for explicit approval before adding a team admin to a private channel, which team admins to joining private channels via crafted permalink links without explicit consent from them...