Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

MAL-2025-190822 Malicious code in @quick-start-soft/quick-markdown-compose (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4390993c4dc5c3a55b6da923961e34a8fa5caa1f06de7f3ac1ce24dba811c018 The package @quick-start-soft/quick-markdown-compose was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190828 Malicious code in @trigo/atrix-pubsub (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 774898dc5178ad4bd2128a0ec966ceb51a9cc46c9884a0618869d7525c96260c The package @trigo/atrix-pubsub was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190805 Malicious code in @ensdomains/ens-archived-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c494307ab46ed2af70af69daaf50ee6ce9bee9d65e2f9610c692e97db58c7526 The package @ensdomains/ens-archived-contracts was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190691 Malicious code in @zapier/secret-scrubber (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c109e973086267fe5b99a110c559267a26254a0bb87dcffbaf3fb69ea4bbca75 The package @zapier/secret-scrubber was found to contain malicious code. Source: ghsa-malware...

CVE-2025-11368 LearnPress – WordPress LMS Plugin <= 4.2.9.4 - Missing Authorization to Unauthenticated Arbitrary Callback Execution to Information Exposure

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 4.2.9.4. This is due to missing capability checks in the REST endpoint /wp-json/lp/v1/loadcontentviaajax which allows arbitrary callback execution of...

Everest Ransomware Says It Breached Brazilian Energy Giant Petrobras

Everest ransomware claims to have stolen over 180GB of seismic survey data from Petrobras, demanding contact through qTox with a countdown in place...

Online Voting System /login.php File SQL Injection Vulnerability

Online Voting System is an online voting system. Online Voting System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter Username in the file /login.php. An attacker can exploit this vulnerability to execute...

EUVD-2025-197759

TenderDocTransfer developed by Chunghwa Telecom has a Arbitrary File Copy and Paste vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection in the APIs, unauthenticated remote attackers could...

CVE-2025-12482 Booking for Appointments and Events Calendar – Amelia <= 1.2.35 - Unauthenticated SQL Injection via search

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL Injection via the ‘search’ parameter in all versions up to, and including, 1.2.35 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

@apollo/composition has Improper Enforcement of Access Control on Interface Types and Fields

Summary A vulnerability in Apollo Federation's composition logic allowed some queries to Apollo Router to improperly bypass access controls on types/fields. Apollo Federation incorrectly allowed user-defined access control directives on interface types/fields, which could be bypassed by instead...

CVE-2025-13169 code-projects Simple Online Hotel Reservation System add_query_reserve.php sql injection

A security vulnerability has been detected in code-projects Simple Online Hotel Reservation System 1.0. This vulnerability affects unknown code of the file /addqueryreserve.php. Such manipulation of the argument roomid leads to sql injection. The attack can be executed remotely. The exploit has...

ReQuest Serious Play Pro 安全漏洞

ReQuest Serious Play Pro is a media server from ReQuest Serious Play USA. A security vulnerability exists in ReQuest Serious Play Pro that stems from a specially crafted HTTP GET request that can cause the device to shut down or reboot, potentially resulting in an interruption of service...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990918)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990918 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/via: Avoid potential array out-of-bound in addsecretdacpath sndhdagetconnections can...

MAL-2025-155469 Malicious code in guras-via-teajawa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82268b81e4689f6e6306270b2c3b4bb3d509293f2038d2efdc729691021347d7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-63154

TOTOLink A7000R V9.1.0u.6115B20201022 was discovered to contain a stack overflow in the addEffect parameter of the urldecode function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

[SECURITY] Fedora 43 Update: uv-0.9.7-2.fc43

An extremely fast Python package installer and resolver, written in Rust. Designed as a drop-in replacement for common pip and pip-tools workflows. Highlights: =E2=80=A2 =E2=9A=96=EF=B8=8F Drop-in replacement for common pip, pip-tools, and virtualenv commands. =E2=80=A2 =E2=9A=A1=EF=B8=8F 10-100x...