MAL-2025-49349 Malicious code in pkg-with-optional (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a7273cf1aeda44bb1d1c2b9e1336bae21d1e1c6606ec940757a218d7761a81b The package pkg-with-optional was found to contain malicious code. Source: ossf-package-analysis...

CVE-2025-43423

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Tahoe 26.1, visionOS 26.1. An attacker with physical access to an unlocked device paired with a Mac may be able to view sensitive...

CVE-2025-43423

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Tahoe 26.1, visionOS 26.1. An attacker with physical access to an unlocked device paired with a Mac may be able to view sensitive...

CVE-2025-43423

A logging issue in the Audio component of Apple products allows an attacker with physical access to an unlocked device paired with a Mac to view sensitive user information within system logs. This vulnerability is caused by insufficient data redaction and has been addressed in iOS 18.7.2 , iPadOS...

CVE-2025-11890: Missing Authorization

The Crypto Payment Gateway with Payeer for WooCommerce plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 1.0.3. This is due to the plugin not properly verifying a payments status through server-side validation though the /wc-api/bp-payeer-gateway-callback...

PT-2025-44859

Name of the Vulnerable Software and Affected Versions iOS versions prior to 18.7.2 iPadOS versions prior to 18.7.2 Description A logging issue existed that allowed an attacker with physical access to an unlocked device paired with a Mac to view sensitive user information in system logging. The...

CVE-2025-63442: Improper Neutralization of Input During Web Page Generation

Simple User Management System with PHP-MySQL v1.0 is vulnerable to Cross-Site Scripting XSS via the Profile Section. The system fails to properly sanitize user input, allowing attackers to inject and execute arbitrary JavaScript when the input is displayed in the browser...

CVE-2025-61118

mCarFix Motorists App version 2.3 package name com.skytop.mcarfix, developed by Paniel Mwaura, contains improper access control vulnerabilities. Attackers may bypass verification to arbitrarily register accounts, and by tampering with sequential numeric IDs, gain unauthorized access to user data...

Execution with Unnecessary Privileges

Overview Affected versions of this package are vulnerable to Execution with Unnecessary Privileges via the bulk create API with the overwrite action. An attacker can modify existing records by submitting crafted requests with only CREATE privileges. Remediation Upgrade apache-airflow-core to...

MAL-2025-49095 Malicious code in create-response (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 242fbf21e70f13fac07ad9415ae43d91bc17823a931c07c5143ae7f7119a2b24 The package create-response was found to contain malicious code. Source: ossf-package-analysis...

CVE-2025-34274: Execution with Unnecessary Privileges

Nagios Log Server versions prior to 2024R2.0.3 contain an execution with unnecessary privileges vulnerability as it runs its embedded Logstash process as the root user. If an attacker is able to compromise the Logstash process - for example by exploiting an insecure plugin, pipeline configuration...

CVE-2025-11627: Improper Output Neutralization for Logs

The Site Checkup Debug AI Troubleshooting with Wizard and Tips for Each Issue plugin for WordPress is vulnerable to log file poisoning in all versions up to, and including, 1.47. This makes it possible for unauthenticated attackers to insert arbitrary content into log files, and potentially cause...

Malicious code in skyscanner-with-prettier (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 269ee691d4871e49dccfe0f756848ea5ef13360c6ff86d64bc7ddb718ac5d423 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2025-36799

Malicious code in skyscanner-with-prettier npm...

MAL-2025-49041 Malicious code in skyscanner-with-prettier (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 269ee691d4871e49dccfe0f756848ea5ef13360c6ff86d64bc7ddb718ac5d423 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview skyscanner-with-prettier is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

CVE-2025-1549: Improper Neutralization of Special Elements used in a Command

A local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client on Windows enables a local user to execute arbitrary commands with elevated privileges on the Windows system. This vulnerability is an additional unmitigated attack path for CVE-2024-4944. This vulnerability i...

CVE-2015-10146: Improper Neutralization of Special Elements used in an SQL Command

The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possibl...

CVE-2025-43017: Execution with Unnecessary Privileges

HP ThinPro 8.1 System management application failed to verify user's true id. HP has released HP ThinPro 8.1 SP8, which includes updates to mitigate potential vulnerabilities...

com.aol.microservices:micro-tomcat (>=0.85, <=0.91.11), com.aol.microservices:micro-tomcat-with-jersey (>=0.85, <=0.91.11) +6 more potentially affected by CVE-2025-55752 via org.apache.tomcat.embed:tomcat-embed-core (9.0.0.m6)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 9.0.0.m6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.aol.microservices:micro-tomcat =0.85, =0.85, =1.0.0, =1.0.0, =1.0.1 -...