Security Bulletin: IBM Navigator Mobile Android app is vulnerable due to improper access control (CVE-2022-38388)

Summary Improper access control in the IBM Navigator Mobile Android app may allow an authenticated user to potentially enable information disclosure via local access CVE-2022-38388. Vulnerability Details CVEID:CVE-2022-38388 DESCRIPTION: IBM Navigator Mobile Android app could allow a local user t...

Splunk Cloud Platform and Splunk Enterprise have vulnerabilities related to cross-site request forgeing attacks.

Splunk Cloud Platform and Splunk Enterprise are both products of Splunk Corporation, U.S.A. Splunk Cloud Platform is a powerful data collection, processing, and analytics service.Splunk Enterprise is a suite of data collection and analytics software. A cross-site request forgery vulnerability...

Splunk Access Control Vulnerability

Splunk is a suite of data collection and analysis software from Splunk, Inc. It is used to collect, index, and analyze and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines, and cloud. Splunk suffers from an Access Control Error...

CVE-2025-20228: Cross-Site Request Forgery (CSRF)

In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.2.2403.108, and 9.1.2312.204, a low-privileged user that does not hold the "admin" or "power" Splunk roles could change the maintenance mode state of App Key Value Store KVStore through a...

WordPress City Store theme <= 1.4.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Theme City Store versions = 1.4.5...

CVE-2025-2707

A vulnerability, which was classified as critical, has been found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected by this issue is some unknown functionality of the file /app-api/infra/file/upload of the component Front-End Store Interface. The manipulation of the argument path leads to path...

CVE-2025-2707

A vulnerability, which was classified as critical, has been found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected by this issue is some unknown functionality of the file /app-api/infra/file/upload of the component Front-End Store Interface. The manipulation of the argument path leads to path...

MAL-2025-2616 Malicious code in default-shared-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf531d5c01de5684ee7710ddc70fe7e2d6b8960616b4c3d8973fcbe9b97f885c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in default-shared-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf531d5c01de5684ee7710ddc70fe7e2d6b8960616b4c3d8973fcbe9b97f885c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2617 Malicious code in epic-react-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6d43c90ef27f311e9b6bb49fb715a80a16f68e0adef519b5f389a00ceeb8bbf3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in epic-react-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6d43c90ef27f311e9b6bb49fb715a80a16f68e0adef519b5f389a00ceeb8bbf3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-2707: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability, which was classified as critical, has been found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected by this issue is some unknown functionality of the file /app-api/infra/file/upload of the component Front-End Store Interface. The manipulation of the argument path leads to path...

GHSA-747F-WW56-4Q4H Kedro deserialization vulnerability

A Remote Code Execution RCE vulnerability has been identified in the Kedro ShelveStore class version 0.19.8. This vulnerability allows an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The ShelveStore class use...

elemeno-ai-sdk (>=0.0.5, <=0.6.11), elemeno-mlops-cli (>=0.0.1, <=0.0.4) +12 more potentially affected by CVE-2024-11602 via feast (>=0.9.3, <=0.39.1)

feast PYPI version =0.9.3, =0.0.5, =0.0.1, =0.1.0, =0.3.0, =0.1.0rc3, =0.0.2, =1.0.0, =0.1.0, =0.0.1, =0.0.23 Source cves: CVE-2024-11602 Source advisory: OSV:GHSA-WXPC-2674-RXVW...

PT-2025-12291

Name of the Vulnerable Software and Affected Versions Kedro version 0.19.8 Description A Remote Code Execution RCE issue has been identified, allowing an attacker to execute arbitrary Python code via deserialization of malicious payloads, potentially leading to a full system compromise. The...

dasd_copy_pair_store() function in the DoS

The vulnerability of the dasdcopypairstore function in the drivers/s390/block/dasddevmap.c module of the Linux operating system is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

New Ad Fraud Campaign Exploits 331 Apps with 60M+ Downloads for Phishing and Intrusive Ads

Cybersecurity researchers have warned about a large-scale ad fraud campaign that has leveraged hundreds of malicious apps published on the Google Play Store to serve full-screen ads and conduct phishing attacks. "The apps display out-of-context ads and even try to persuade victims to give away...

Malicious code in adl-commons-lib-node-pp-parameter-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c31f2a945e64c66f470f0fd05f5096d25dccd70f1efe9f48eefc252686506e7a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2026-52616

Name of the Vulnerable Software and Affected Versions Flowise affected versions not specified Description An unauthenticated path traversal issue exists in the '/api/v1/document-store/loader/process' endpoint. This flaw allows attackers to write arbitrary files to the filesystem by using...

SUSE CVE-2025-21860

In the Linux kernel, the following vulnerability has been resolved: mm/zswap: fix inconsistency when zswapstorepage fails Commit b7c0ccdfbafd "mm: zswap: support large folios in zswapstore" skips charging any zswap entries when it failed to zswap the entire folio. However, when some base pages ar...