CVE-2025-7030: Privilege Defined With Unsafe Actions

Privilege Defined With Unsafe Actions vulnerability in Drupal Two-factor Authentication TFA allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Two-factor Authentication TFA: from 0.0.0 before 1.11.0...

CVE-2024-49783: Generation of Predictable IV with CBC Mode

IBM OpenPages with Watson 8.3 and 9.0 could provide weaker than expected security in storage of encrypted data. If an authenticated remote attacker with access to the database or a local attacker with access to server files could extract the encrypted data, they could exploit this vulnerability t...

Malicious code in with-shadcn (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 01233cb16b11624de4b6a0eb8110923a4611ba7c757ee2a9bdb46370b77099d6 Any computer that has this package installed or running should be considered...

Malicious code in with-next-intl (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3d19de7a1f0382187b4331c426d9c88dddd8734112cac8bfd611c4edadf922ad Any computer that has this package installed or running should be considered...

Malicious code in caglass (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e455bdcd125bc7e808bd44aefba85c1ef5838aa36b61d5fd75f2c6f026bce1b4 Any computer that has this package installed or running should be considered...

Malicious code in draw-with-twilio (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 423b3d27265f2438de29b913385910b4d4eef30e2934306c1951196ab07f4a5d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in draw-with-twilio

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in jsmdc (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6d2c0aff7f35c88859f22a83734bb661c5d66f25262f8c09e97870b387cddbc2 Any computer that has this package installed or running should be considered...

CVE-2025-53308 WordPress Image Slider With Description plugin <= 9.2 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in gopiplus Image Slider With Description allows Stored XSS. This issue affects Image Slider With Description: from n/a through 9.2...

CVE-2025-5398: Improper Neutralization of Input During Web Page Generation

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of a templating engine in all versions up to, and including, 3.10.2.1 due to insufficient output escaping on user data passed through the template. This mak...

CVE-2025-53308: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in gopiplus Image Slider With Description image-slider-with-description allows Stored XSS.This issue affects Image Slider With Description: from n/a through = 9.2...

nOAuth Vulnerability Still Affects 9% of Microsoft Entra SaaS Apps Two Years After Discovery

New research has uncovered continued risk from a known security weakness in Microsoft's Entra ID, potentially enabling malicious actors to achieve account takeovers in susceptible software-as-a-service SaaS applications. Identity security company Semperis, in an analysis of 104 SaaS applications,...

MAL-2025-5356 Malicious code in agoda.cronos.activities.client-side (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0928f5727876dc4dcdb9f1869badd5793565d97277f96836f85b5413f44bcaf9 Any computer that has this package installed or running should be considered...

Taiwan Is Rushing to Make Its Own Drones Before It's Too Late

Unmanned vehicles are increasingly becoming essential weapons of war. But with a potential conflict with China looming large, Taiwan is scrambling to build a domestic drone industry from scratch...

Accurate BGV Parameters Selection: Accounting for Secret and Public Key Dependencies in Average-Case Analysis

The Brakerski-Gentry-Vaikuntanathan BGV scheme is one of the most significant fully homomorphic encryption FHE schemes. It belongs to a class of FHE schemes whose security is based on the presumed intractability of the Learning with Errors LWE problem and its ring variant RLWE. Such schemes deal...

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow via the hashmapgetwithhash function in the gumbo-parser/src/hashmap.c file. An attacker can cause a crash or disrupt service by providing crafted input. Note: According to the maintainer of the package the cod...

UBUNTU-CVE-2025-6494

A vulnerability was found in sparklemotion nokogiri c29c920907366cb74af13b4dc2230e9c9e23b833. It has been classified as problematic. This affects the function hashmapgetwithhash of the file gumbo-parser/src/hashmap.c. The manipulation leads to heap-based buffer overflow. An attack has to be...

CVE-2025-6490 sparklemotion nokogiri hashmap.c hashmap_set_with_hash heap-based overflow

A vulnerability was found in sparklemotion nokogiri c29c920907366cb74af13b4dc2230e9c9e23b833 and classified as problematic. This issue affects the function hashmapsetwithhash of the file gumbo-parser/src/hashmap.c. The manipulation leads to heap-based buffer overflow. An attack has to be approach...

Malicious code in mydummyproject-zyp (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b7385c16c060ed95f15f1eed55e51d69f17bc1768a7ed955da163b7e314b62df Any computer that has this package installed or running should be considered...

CVE-2025-5125: Improper Neutralization of Input During Web Page Generation

The Custom Post Carousels with Owl WordPress plugin before 1.4.12 uses the featherlight library and makes use of the data-featherlight attribute without sanitizing before using it...