CVE-2025-52954

CVE-2025-52954 affects Juniper Networks Junos OS Evolved: a Missing Authorization vulnerability in the internal VRF allows a local, low-privileged user who can send packets over the VRF to gain root privileges and modify configuration, enabling system compromise. Impact is elevation of privileges...

MAL-2025-5790 Malicious code in pkgsite (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5342744a43bef74cacd9dd96822d1ef228384fe12a9a4d22fd8cc0a4fcfde6c1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5800 Malicious code in tyrtle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6e13a7780a46e82cf53e4515084323c593dd81279f30c4010258429cb0beaba Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6156 Malicious code in cookiefunctions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d8afa900a1619d7588b19e54f31e967476f48fc0d956d06cd6dd045d965d36a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Critical mcp-remote Vulnerability Enables Remote Code Execution, Impacting 437,000+ Downloads

Cybersecurity researchers have discovered a critical vulnerability in the open-source mcp-remote project that could result in the execution of arbitrary operating system OS commands. The vulnerability, tracked as CVE-2025-6514 , carries a CVSS score of 9.6 out of 10.0. "The vulnerability allows...

Malicious code in clock-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94f232d3ca0a55cee4a30418e75111d62c8ce4b44baa018c72400b9aee310ab4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in grafana-polystat-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 16c78bb4eab009d5ca0b36e692021c2f9d402df7bef90eb6642dee10f8e69095 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5772 Malicious code in dt-automation-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6eeff9a72134c244b969bcd674f473359fea30bfe4423298194db75e255a238 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dt-automation-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6eeff9a72134c244b969bcd674f473359fea30bfe4423298194db75e255a238 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tv-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware addb927c8910ec93507080bad17c52b12df866249c823ceb79970bda06bc74d6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in k6-studio-ui-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 066503bf35690fb58f38fa44cc7e64d0eaf5a0e5f352167029b6a5ed00a448b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-42964

SAP NetWeaver Enterprise Portal Administration is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system...

CVE-2025-42963

A critical vulnerability in SAP NetWeaver Application server for Java Log Viewer enables authenticated administrator users to exploit unsafe Java object deserialization. Successful exploitation can lead to full operating system compromise, granting attackers complete control over the affected...

CVE-2025-42959

An unauthenticated attacker may exploit a scenario where a Hashed Message Authentication Code HMAC credential, extracted from a system missing specific security patches, is reused in a replay attack against a different system. Even if the target system is fully patched, successful exploitation...

MAL-2025-5754 Malicious code in @frontend-clients/wallet-web (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4a1c436afb2775f8924af545aabce47a320ce8cab9c12dce05ed9e922a67d456 Any computer that has this package installed or running should be considered...

Ubuntu: Security Advisory (USN-7610-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MAL-2025-5747 Malicious code in @nomicsfoundation/sdk-test1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dd1a561b2ed5703af862c67f4c412afa3ba942efe78ee0b7fc55066fc7c8c316 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @nomicsfoundation/hardhat-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 47ee3c366ab380260bf1b14296eaac2bfe3c76b726ea2c18b271e9e2af4b8f7a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5696 Malicious code in grafana-iot-sitewise-datasource (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 97ddf55083335c582abfc892f9b5d93c8b5ee5232f0fa07ae4da45dd8eadc84b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vscode-oneapi-environment-configurator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e8b4992dcea3340ef6012db58cede2756b194c824f67c49b3ebae3b30a9b946c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...