MAL-2025-42029 Malicious code in mpesa-backoffice-frontend (npm)

The package communicates with a domain associated with malicious activity...

CVE-2025-54142

Akamai Ghost before 2025-07-21 allows HTTP Request Smuggling via an OPTIONS request that has an entity body, because there can be a subsequent request within the persistent connection between an Akamai proxy server and an origin server, if the origin server violates certain Internet standards...

CVE-2025-48363: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Metin Saraç Popup for CF7 with Sweet Alert cf7-sweet-alert-popup allows Cross Site Request Forgery.This issue affects Popup for CF7 with Sweet Alert: from n/a through = 1.6.5...

Linux Distros Unpatched Vulnerability : CVE-2018-19871

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Qt before 5.11.3. There is QTgaFile Uncontrolled Resource Consumption. CVE-2018-19871 Note that Nessus relies on the presence of the...

JetBrains IntelliJ IDEA Improper Access Control Vulnerability

JetBrains IntelliJ IDEA is an integrated development environment IDE developed by JetBrains , designed to improve developer productivity and code quality , mainly for Java programming , but also supports Kotlin, Web, Spring and other languages and frameworks . JetBrains IntelliJ IDEA suffers from...

Linux Distros Unpatched Vulnerability : CVE-2020-15866

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mruby through 2.1.2-rc has a heap-based buffer overflow in the mrbyieldwithclass function in vm.c because of incorrect VM stack handling. It can be triggered vi...

Linux Distros Unpatched Vulnerability : CVE-2023-23913

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are assigned the...

This Week in Spring - August 26th, 2025

Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm writing this from the floor of SpringOne, live from lovely Las Vegas! As you can imagine, I've got to get back into it, so we'll make this one a quick one. And if you're here, be sure to say "hi"! In last week's A Bootifu...

MAL-2025-41340 Malicious code in typescript-5.8 (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e5beba7c2e6c6b468d2708bf24ba287dcdd016c8345420d5535bf883e8158af9 The OpenSSF Package Analysis project identified 'typescript-5.8' @...

Malicious code in rush-c (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 87ef3df74ad4f8e39b88d949f7728ee14fe93ba9ff8edb5efa5ca9a154630504 The OpenSSF Package Analysis project identified 'rush-c' @ 99.0.9 npm...

Malicious code in remark-cross-site-link-plugin (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8c7fd443fcaba7627f28aa45f16610fef8703f54b0f2dad9c22642c2d428a278 The OpenSSF Package Analysis project identified...

Malicious code in package-extractor-test-02 (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 697a859ea4113bd747e08d7e374aff232885ac108926a2f0b8be99612d3e67d0 The OpenSSF Package Analysis project identified...

CVE-2025-9257 Uniong｜WebITR - Arbitrary File Reading through Path Traversal

WebITR developed by Uniong has an Arbitrary File Reading vulnerability, allowing remote attackers with regular privileges to exploit Absolute Path Traversal to download arbitrary system files...

CVE-2025-57728

In JetBrains IntelliJ IDEA before 2025.2 improper access control allowed Code With Me guest to discover hidden files...

CVE-2025-55634: Uncontrolled Resource Consumption

Incorrect access control in the RTMP server settings of Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.46622503122283 allows unauthorized attackers to cause a Denial of Service DoS via initiating a large number of simultaneous ffmpeg-based stream pushes...

CVE-2025-55631: Uncontrolled Resource Consumption

Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.46622503122283 was discovered to manage users' sessions system wide instead of an account-by-account basis, potentially leading to a Denial of Service DoS via resource exhaustion. NOTE: the Supplier reports that the...

CVE-2025-55629: Creation of Temporary File With Insecure Permissions

Insecure permissions in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.46622503122283 allow attackers to arbitrarily change other users' passwords via manipulation of the userName value...

CVE-2025-55626: Improper Access Control

An Insecure Direct Object Reference IDOR vulnerability in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.46622503122283 allows unauthorized attackers to access the Admin-only settings and edit the session storage...

CVE-2025-55637: Improper Neutralization of Special Elements used in a Command

Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.46622503122283 was discovered to contain a command injection vulnerability via the setddnspipsystem function...

CVE-2025-55630: Improper Access Control

A discrepancy in the error message returned by the login function of Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.46622503122283 when entering the wrong username and password allows attackers to enumerate existing accounts...