MAL-2025-153685 Malicious code in billa-35 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 015a65e5f189cead34be4a53a7f7a0a43ab39845214b031cde11311d28bb8077 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-163989 Malicious code in parwo-poke2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 346b225c378f3d2a7f8db5265c91605b98a7393cceef713d22a51c31299b6023 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-11795 JPG File Parsing Out-of-Bounds Write Vulnerability

A maliciously crafted JPG file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process...

CVE-2025-64280

A SQL Injection Vulnerability in CentralSquare Community Development 19.5.7 allows attackers to inject SQL via the permitno field...

CVE-2025-11367

The N-central Software Probe 2025.4 is vulnerable to Remote Code Execution via deserialization...

CVE-2025-11367 N-central windows software probe Remote Code Execution

The N-central Software Probe 2025.4 is vulnerable to Remote Code Execution via deserialization...

CVE-2025-11367 N-central windows software probe Remote Code Execution

The N-central Software Probe 2025.4 is vulnerable to Remote Code Execution via deserialization...

CVE-2025-11367

The CVE-2025-11367 entry affects the N-central Software Probe (windows) prior to version 2025.4. The vulnerability relies on deserialization, allowing remote code execution with network access and no authentication. Impact is described as full compromise of affected systems (high confidentiality,...

Update: Implementation Guidance for Emergency Directive on Cisco ASA and Firepower Device Vulnerabilities

CISA has released Emergency Cisco Directive 25-03 Implementation Guidance to assist federal agencies in addressing critical vulnerabilities in Cisco Adaptive Security Appliances ASA and Firepower devices. Emergency Directive 25-03: Identify and Mitigate Potential Compromise of Cisco Devices, issu...

bind: Cache poisoning attacks with unsolicited RRs

A vulnerability exists in BIND’s DNS resolver logic that makes it overly permissive when accepting resource records RRs in responses. Under certain conditions, this flaw allows attackers to inject unsolicited or forged DNS records into the cache. This can be exploited to poison the resolver cache...

Security update for runc

This update for runc fixes the following issues: Update to runc v1.3.3. Upstream changelog is available from . bsc1252232 CVE-2025-31133 CVE-2025-52565 CVE-2025-52881 Update to runc v1.3.2. Upstream changelog is available from bsc1252110 Includes an important fix for the CPUSet translation for...

RHSA-2025:20801 Red Hat Security Advisory: libtiff security update

Bulletin has no description...

CVE-2025-64403

CVE-2025-64403 affects Apache OpenOffice up to version 4.1.15 (Calc external data sources and other external links). Root cause is missing authorization checks that allow an attacker to craft a document to load links without prompting the user. A fix is available in OpenOffice 4.1.16. Other relat...

Prototype Pollution

dref is vulnerable to Prototype Pollution. The vulnerability is due to improper validation of user-supplied input in the lib.set function, which allows an attacker to inject malicious properties into the Object.prototype, leading to a potential denial of service DoS condition...

Phishing Attack

github.com/rancher/rancher is vulnerable to Phishing Attack. The vulnerability is due to a weakness in the custom SAML authentication protocol used by the Rancher CLI, which allows an attacker to steal authentication tokens through crafted phishing attempts...

EUVD-2025-113173

Malicious code in global-karma-socketio-algol npm...

EUVD-2025-114440

Malicious code in docusaurus-kinetic-leda-karma npm...

EUVD-2025-112034

Malicious code in jwt-magellan-sedna-stop npm...

EUVD-2025-113675

Malicious code in fetch-celeste-link-quantum npm...

Malicious code in inquirer-prettier-plugin-markdown-writable-fomalhaut (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aba576cee921af273a381ecdd9f50e7948d25e4e33e507595011c39819ada9e9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...