Malware in internal-payroll-lib-v2

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2025-26692

Quick Agent V3 and Quick Agent V2 contain an issue with improper limitation of a pathname to a restricted directory 'Path Traversal'. If exploited, arbitrary code may be executed by a remote unauthenticated attacker with the Windows system privilege where the product is running...

GHSA-WFM2-RQ5G-F8V5 @account-kit/smart-contracts Allowlist Module Bypass Vulnerability

Summary Allowlist module contains a bypass vulnerability Details The logic for using an allowlist on a Modular Account V2 contained a bug that allowed session keys to bypass any allowlist configuration Action If you are using @aa-sdk and/or @account-kit/smart-contracts between the versions of...

CVE-2025-27937: Improper Limitation of a Pathname to a Restricted Directory

Quick Agent V3 and Quick Agent V2 contain an issue with improper limitation of a pathname to a restricted directory 'Path Traversal'. If exploited, an arbitrary file in the affected product may be obtained by a remote attacker who can log in to the product...

CVE-2025-31144: Improper Restriction of Communication Channel to Intended Endpoints

Quick Agent V3 and Quick Agent V2 contain an issue with improper restriction of communication channel to intended endpoints. If exploited, a remote unauthenticated attacker may attempt to log in to an arbitrary host via Windows system where the product is running...

CVE-2025-26692: Improper Limitation of a Pathname to a Restricted Directory

Quick Agent V3 and Quick Agent V2 contain an issue with improper limitation of a pathname to a restricted directory 'Path Traversal'. If exploited, arbitrary code may be executed by a remote unauthenticated attacker with the Windows system privilege where the product is running...

CVE-2025-27937

CVE-2025-27937 affects SIOS Quick Agent V3 and V2 (Windows). The issue is a path traversal vulnerability (improper limitation of a pathname to a restricted directory) in the product, allowing a remote attacker to obtain an arbitrary file in the affected product after logging in. Affected versions...

PT-2025-18027 · Unknown · Quick Agent V3 +1

Name of the Vulnerable Software and Affected Versions: Quick Agent V3 and Quick Agent V2 affected versions not specified Description: The issue involves an improper limitation of a pathname to a restricted directory, commonly referred to as a Path Traversal issue. If exploited, an arbitrary file ...

PT-2025-18026 · Unknown · Quick Agent V3 +1

Name of the Vulnerable Software and Affected Versions: Quick Agent V3 affected versions not specified Quick Agent V2 affected versions not specified Description: The issue is related to improper limitation of a pathname to a restricted directory, commonly known as a 'Path Traversal' vulnerability...

CVE-2025-2811: Inefficient Regular Expression Complexity

A vulnerability was found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT250...

CVE-2025-46272 Planet Technology Network Products OS Command Injection

WGS-80HPT-V2 and WGS-4215-8T2S are vulnerable to a command injection attack that could allow an unauthenticated attacker to execute OS commands on the host system...

CVE-2025-46272: Improper Neutralization of Special Elements used in an OS Command

WGS-80HPT-V2 and WGS-4215-8T2S are vulnerable to a command injection attack that could allow an unauthenticated attacker to execute OS commands on the host system...

CVE-2025-46275: Missing Authentication for Critical Function

WGS-80HPT-V2 and WGS-4215-8T2S are missing authentication that could allow an attacker to create an administrator account without knowing any existing credentials...

PT-2025-17864 · Unknown · Wgs-4215-8T2S +1

Name of the Vulnerable Software and Affected Versions: WGS-80HPT-V2 affected versions not specified WGS-4215-8T2S affected versions not specified Description: The issue is related to missing authentication in the affected devices, which could allow an attacker to create an administrator account...

Comfast CF-616AC V2 of Shenzhen Sihai Zonglian Network Technology Co., Ltd. suffers from logic flaw vulnerability

Comfast CF-616AC V2 is a wireless router. Comfast CF-616AC V2 has a logic flaw vulnerability that can be exploited by an attacker to cause a denial of service...

PT-2025-15398

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A soft lockup issue has been resolved in the Linux kernel. The problem occurs when the driver allocates a large buffer, such as a Memory Region MR over 100GB, which requires a...

SUSE CVE-2025-29072

An integer overflow in Nethermind Juno before v.12.05 within the Sierra bytecode decompression logic within the "cairo-lang-starknet-classes" library could allow remote attackers to trigger an infinite loop and high CPU usage by submitting a malicious Declare v2/v3 transaction. This results in a...

SUSE CVE-2025-2704

OpenVPN version 2.6.1 through 2.6.13 in server mode using TLS-crypt-v2 allows remote attackers to trigger a denial of service by corrupting and replaying network packets in the early handshake phase...

OpenVPN Server versions 2.6.1 <= 2.6.13 DoS

OpenVPN from 2.6.1 through 2.6.13, setup with tls-crypt-v2. is affected by a denial of service vulnerability. A local attacker who can monitor network traffic, can inject specially crafted packets during the tls-crypt2-v2 handshake and corrupt the server. %NASLMINLEVEL 80900 C Tenable, Inc...

MAL-2025-3093 Malicious code in cdk-construct-library-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7030a0b9d7d1eed660c8a53ad26a551201ff0ee4a7ee399b284e9c0b4a61214f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...