MAL-2025-4918 Malicious code in ac-object (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c8e3af8316e9f831ecb0049a57731e32431e9c7ca54d47aa83341f5774ccd83 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-49304: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CodeManas Search with Typesense search-with-typesense allows Stored XSS.This issue affects Search with Typesense: from n/a through = 2.0.10...

CVE-2025-24772: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in cmsMinds Pay with Contact Form 7 pay-with-contact-form-7 allows Cross Site Request Forgery.This issue affects Pay with Contact Form 7: from n/a through = 1.0.4...

Malicious code in pages-admin (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

A Symmetric LWE-Based Multi-Recipient Cryptosystem

This article describes a post-quantum multirecipient symmetric cryptosystem whose security is based on the hardness of the LWE problem. In this scheme a single sender encrypts multiple messages for multiple recipients generating a single ciphertext which is broadcast to the recipients. Each...

Malware in basic-with-react-hooks

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in basic-with-react-hooks (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d7efadad57bdbe52801b9d31e36cd5cd4678d838d46d71c95ab940aee65a12bc Any computer that has this package installed or running should be considered...

CVE-2025-4567: Improper Neutralization of Input During Web Page Generation

The Post Slider and Post Carousel with Post Vertical Scrolling Widget WordPress plugin before 3.2.10 does not validate and escape some of its Widget options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform...

CVE-2025-4431: Improper Access Control

The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fipsaveattachfeatured function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers...

askdoc (0.1.1), chat-with-mlx (>=0.1.6, <=0.1.11) +1 more potentially affected by CVE-2025-48889 via gradio (4.19.2)

gradio PYPI version 4.19.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - askdoc 0.1.1 - chat-with-mlx =0.1.6, =0.1.11 - hugegraph-llm 1.3.0 Source cves: CVE-2025-48889 Source advisory: OSV:GHSA-8JW3-6X8J-V96G...

chat-with-mlx (>=0.1.0, <=0.1.5), megatts (3.0.0) potentially affected by CVE-2025-48889 via gradio (4.19.1)

gradio PYPI version 4.19.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - chat-with-mlx =0.1.0, =0.1.5 - megatts 3.0.0 Source cves: CVE-2025-48889 Source advisory: OSV:GHSA-8JW3-6X8J-V96G...

Security Bulletin: Astronomer with IBM is vulnerable to unauthenticated access due to the Grafana package (CVE-2021-39226)

Summary Grafana is used by Astronomer with IBM as part of data visualization. Vulnerability Details CVEID:CVE-2021-39226 DESCRIPTION: Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest...

CVE-2025-5196: Execution with Unnecessary Privileges

A vulnerability has been found in Wing FTP Server up to 7.4.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Lua Admin Console. The manipulation leads to execution with unnecessary privileges. The attack can be launched remotely. The...

MADCAT: Combating Malware Detection under Concept Drift with Test-Time Adaptation

We present MADCAT, a self-supervised approach designed to address the concept drift problem in malware detection. MADCAT employs an encoder-decoder architecture and works by test-time training of the encoder on a small, balanced subset of the test-time data using a self-supervised objective. Duri...

CVE-2025-24638

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in pddring Create with Code create-with-code allows DOM-Based XSS.This issue affects Create with Code: from n/a through = 1.4...

CVE-2024-48509

Learning with Texts LWT 2.0.3 is vulnerable to SQL Injection. This occurs when the application fails to properly sanitize user inputs, allowing attackers to manipulate SQL queries by injecting malicious SQL statements into URL parameters. By exploiting this vulnerability, an attacker could gain...

CVE-2024-30546

Cross-Site Request Forgery CSRF vulnerability in Pixelite Login With Ajax.This issue affects Login With Ajax: from n/a through 4.1...

CVE-2024-1679

The Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the template and javascript label fields in all versions up to, and including, 3.4.6 due to insufficient input sanitization and...

CVE-2024-36625

Zulip 8.3 is vulnerable to Cross Site Scripting XSS via the replaceemojiwithtext function in uiutil.ts...

CVE-2024-51918

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Freshlight Lab Pay With Stripe payments-stripe-gateway allows DOM-Based XSS.This issue affects Pay With Stripe: from n/a through = 1.2.1...