PT-2025-38253

Name of the Vulnerable Software and Affected Versions Dragonfly versions prior to 2.1.0 Description The /api/v1/jobs and /preheats endpoints in the Manager web UI are accessible without authentication. An unauthenticated adversary with network access to a Manager web UI can create, delete, and...

MevzuatTR 安全漏洞

MevzuatTR is an online platform for retrieval and notification of judicial decisions in Turkey by MevzuatTR Turkey. A security vulnerability exists in MevzuatTR versions prior to 12.02.2025 that stems from improper input neutralization and improper UI layer or frame restriction, which could lead ...

Dragonfly doesn't have authentication enabled for some Manager’s endpoints

The /api/v1/jobs and /preheats endpoints in Manager web UI are accessible without authentication. Any user with network access to the Manager can create, delete, and modify jobs, and create preheat jobs. An unauthenticated adversary with network access to a Manager web UI uses /api/v1/jobs endpoi...

Malicious code in @ui-ux-gang/devextreme-rpk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc643d20a812778984d46636db2ea2e7e08c97ca2710b212c0b07a023461df59 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-47967

Insufficient ui warning of dangerous operations in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network...

Malicious code in bsd-form-ui-kit (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-47393 Malicious code in bsd-form-ui-kit (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in @nativescript-community/ui-document-picker (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 46d11dbb6f2ddb5b46be5e63a827af98e3f887baac9c3df11be485d8326089b2 This package was compromised by the Shai-Hulud NPM worm. The malicious payload steal...

MAL-2025-47388 Malicious code in @nativescript-community/ui-label (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: google-open-source-security a815032f1d690295898b5c01bd4d17cb73044eebda75187b2877e8299ded777a This package was compromised by the Shai-Hulud NPM worm. The malicious payload steal...

Malicious code in @nativescript-community/ui-label (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: google-open-source-security a815032f1d690295898b5c01bd4d17cb73044eebda75187b2877e8299ded777a This package was compromised by the Shai-Hulud NPM worm. The malicious payload steal...

CVE-2025-10399

A weakness has been identified in Korzh EasyQuery up to 7.4.0. This issue affects some unknown processing of the file /api/easyquery/models/nwind/fetch of the component Query Builder UI. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been made...

Malicious Package

Overview xo-angular-ui-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview nf-web-ui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious code in @teselagen/ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63813f363810c8dc88bfa35fbd3a365de9e23c00d5543cee6ef87dfb6e61b5a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47280 Malicious code in @teselagen/ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63813f363810c8dc88bfa35fbd3a365de9e23c00d5543cee6ef87dfb6e61b5a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview @cnx-ui/cnx-ui-core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

KLA88014 Multiple vulnerabilities in Mozilla Firefox

Multiple vulnerabilities were found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to execute arbitrary code, spoof user interface, bypass security restrictions, obtain sensitive information. Below is a complete list of vulnerabilities: 1. Use-after-free vulnerability in...

KLA88011 Multiple vulnerabilities in Mozilla Thunderbird

Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to execute arbitrary code, spoof user interface, bypass security restrictions, obtain sensitive information. Below is a complete list of vulnerabilities: 1. Use-after-free vulnerability i...

Malicious code in koa2-swagger-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 31fd12270f2d2a5b53bfaf3aabcbae8d26a7eec21613c28e4673369a33025ba5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @nativescript-community/ui-drawer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 654a91a470f375a9cb4e947721e019c839d4da439a16ad0308c6d183ada0bb55 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...