Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the LIVE SELECT process. An attacker can access unauthorized records by subscribing to live queries on a table and observing data changes triggered by other users, thereby bypassing intended access controls...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the LIVE SELECT process. An attacker can access unauthorized records by subscribing to live queries on a table and observing data changes triggered by other users, thereby bypassing intended access controls...

CVE-2025-59037

DuckDB is an analytical in-process SQL database management system. On 08 September 2025, the DuckDB distribution for Node.js on npm was compromised with malware along with several other packages. An attacker published new versions of four of DuckDB's packages that included malicious code to...

Improper Authentication

Overview Flask-AppBuilder is a simple and rapid application development framework, built on top of Flask. includes detailed security, auto CRUD generation for your models, google charts and much more. Affected versions of this package are vulnerable to Improper Authentication via the reset my...

CVE-2025-58065 Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods

Flask-AppBuilder is an application development framework. Prior to version 4.8.1, when Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database authentication methods, the password reset endpoint remains registered and accessible, despite not being displayed in the user interface...

GHSA-765J-9R45-W2Q2 Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods

Impact When Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database authentication methods, the password reset endpoint remains registered and accessible, despite not being displayed in the user interface. This allows an enabled user to reset their password and be able to create...

PT-2025-37255

Name of the Vulnerable Software and Affected Versions: Flask-AppBuilder versions prior to 4.8.1 Description: Flask-AppBuilder is an application development framework. When configured to use OAuth, LDAP, or other non-database authentication methods, the password reset endpoint remains accessible...

CVE-2025-10229

CVE-2025-10229 remains a open-redirect risk in Freshwork public releases up to 1.2.3. The issue is triggered by manipulating the argument post_logout_redirect_uri in the file /api/v2/logout, enabling a remote attacker to redirect users to an attacker-controlled URL. The vulnerability has been pub...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the API Builder. An attacker can access sensitive object entry information by sending unauthorized requests as a guest user. Remediation Upgrade com.liferay:com.liferay.headless.builder.impl to version 1.0.32...

Protection Mechanism Failure

Overview picklescan is a Security scanner detecting Python Pickle files performing suspicious actions Affected versions of this package are vulnerable to Protection Mechanism Failure when processing ZIP files. An attacker can bypass detection of malicious payloads by crafting ZIP archives with...

Arbitrary Code Injection

Overview @anthropic-ai/claude-code is an Use Claude, Anthropic's AI assistant, right from your terminal. Claude can understand your codebase, edit files, run terminal commands, and handle entire workflows for you. Affected versions of this package are vulnerable to Arbitrary Code Injection via th...

CVE-2025-59045 Stalwart vulnerable to Memory Exhaustion via CalDAV Event Expansion

Stalwart is a mail and collaboration server. Starting in version 0.12.0 and prior to version 0.13.3, a memory exhaustion vulnerability exists in Stalwart's CalDAV implementation that allows authenticated attackers to cause denial-of-service by triggering unbounded memory consumption through...

Allocation of Resources Without Limits or Throttling

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the data: URL handler. An attacker can trigger a denial of service by crafting a data: URL with an excessive...

CVE-2025-10226 PostgreSQL Upgrade from v10 to v17.4 in AxxonSoft Axxon One (C-Werk) 2.0.8 and earlier to Address Multiple Vulnerabilities

Dependency on Vulnerable Third-Party Component CWE-1395 in the PostgreSQL backend in AxxonSoft Axxon One C-Werk 2.0.8 and earlier on Windows and Linux allows a remote attacker to escalate privileges, execute arbitrary code, or cause denial-of-service via exploitation of multiple known CVEs presen...

CVE-2025-59038

Prebid.js is a free and open source library for publishers to quickly implement header bidding. NPM users of prebid 10.9.2 may have been briefly compromised by a malware campaign. The malicious code attempts to redirect crypto transactions on the site to the attackers' wallet. Version 10.10.0 fix...

CVE-2025-59044 Himmelblau vulnerable to GID collision via group name-derived mapping (privilege escalation)

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Himmelblau 0.9.x derives numeric GIDs for Entra ID groups from the group display name when himmelblau.conf idattrmap = name the default configuration. Because Microsoft Entra ID allows multiple groups with the same...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack via the WorkflowException error messages. An attacker can infer the existence of ERC by measuring differences in response times. Remediation Upgrade com.liferay:com.liferay.headless.admin.workflow.impl to version 5.0.83 or...

Timing Attack

Overview com.liferay:com.liferay.portal.vulcan.impl is a Liferay Portal Vulcan Implementation Affected versions of this package are vulnerable to Timing Attack via the WorkflowException error messages. An attacker can infer the existence of ERC by measuring differences in response times...

GHSA-455V-W7R9-3VV9 Cattown is Vulnerable to Uncontrolled Resource Consumption through Inefficient Regular Expression Complexity

Overview A security review of the Cattown identified multiple weaknesses that could potentially impact its stability and security. Affected Versions - All versions below 1.0.2 Description of Vulnerabilities 1. CWE-1333: Inefficient Regular Expression Complexity The package used regular expression...

CVE-2025-59037

DuckDB is an analytical in-process SQL database management system. On 08 September 2025, the DuckDB distribution for Node.js on npm was compromised with malware along with several other packages. An attacker published new versions of four of DuckDB's packages that included malicious code to...