chat-with-mlx (>=0.1.0, <=0.1.5), megatts (3.0.0) potentially affected by CVE-2024-12217 via gradio (4.19.1)

gradio PYPI version 4.19.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - chat-with-mlx =0.1.0, =0.1.5 - megatts 3.0.0 Source cves: CVE-2024-12217 Source advisory: OSV:GHSA-PRPG-P95C-32FV...

CVE-2024-8952

A Server-Side Request Forgery SSRF vulnerability exists in composiohq/composio version v0.4.2, specifically in the /api/actions/execute/WEBTOOLSCRAPEWEBSITECONTENT endpoint. This vulnerability allows an attacker to read files, access AWS metadata, and interact with local services on the system...

drivingwithdogs.co.uk Cross Site Scripting vulnerability OBB-4038244

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2024-48013

Dell SmartFabric OS10 Software, versions 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contains an Execution with Unnecessary Privileges vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges...

CVE-2024-48013

Dell SmartFabric OS10 Software, versions 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contains an Execution with Unnecessary Privileges vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges...

MAL-2025-2341 Malicious code in @contraktor-tech/poc_confusion (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9fb8ec2fd9c3fd1eb30ca17367b62f932aa239c8b9209269913e9c88ea105536 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE CVE-2025-21843

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: avoid garbage value in panthorioctldevquery 'prioritiesinfo' is uninitialized, and the uninitialized value is copied to user object when calling PANTHORUOBJSET. Using memset to initialize 'prioritiesinfo' to avoid th...

MAL-2025-2214 Malicious code in brunch-with-ember-reloaded (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c94fc86135cfd87df4ba0a4de0e2989eb4439bb5d46df9861377f11e3f38ead Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in brunch-with-ember-reloaded (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c94fc86135cfd87df4ba0a4de0e2989eb4439bb5d46df9861377f11e3f38ead Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

com.nirima:docker-plugin (>=0.3.4, <=0.7), org.jenkins-ci.main:jenkins-test-harness (1.557) +9 more potentially affected by CVE-2025-27624 via org.jenkins-ci.main:jenkins-core (1.557)

org.jenkins-ci.main:jenkins-core MAVEN version 1.557 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.nirima:docker-plugin =0.3.4, =1.8.3, =1.2, =1.0, =0.4.5, =0.4.6 Source cves: CVE-2025-27624...

com.nirima:docker-plugin (>=0.3.4, <=0.7), org.jenkins-ci.main:jenkins-test-harness (1.557) +9 more potentially affected by CVE-2025-27622 via org.jenkins-ci.main:jenkins-core (1.557)

org.jenkins-ci.main:jenkins-core MAVEN version 1.557 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.nirima:docker-plugin =0.3.4, =1.8.3, =1.2, =1.0, =0.4.5, =0.4.6 Source cves: CVE-2025-27622...

Low: docker

Issue Overview: golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors...

fluoriclogppka (0.2.7), machine-learning-with-graph (>=0.0.2, <=0.0.3) +1 more potentially affected by unknown CVE via dgl (1.1.2)

dgl PYPI version 1.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on dgl and may be impacted: - fluoriclogppka 0.2.7 - machine-learning-with-graph =0.0.2, =0.0.3 - virp 1.0.0 Source cves: unknown CVE Source advisory: OSV:GHSA-3X5X-FW77-G54C...

CVE-2024-13777: Deserialization of Untrusted Data

The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.91 via deserialization of untrusted input from the 'margs' parameter. This makes it possible for unauthenticated attackers to inject a PHP...

CVE-2025-0433: Improper Neutralization of Input During Web Page Generation

The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 2.0.7.1 due to insufficient input sanitization and output...

CVE-2024-9618: Improper Neutralization of Input During Web Page Generation

The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 2.0.7.2 due to insufficient input sanitization and output...

softhotelesbariloche.com Cross Site Scripting vulnerability OBB-4031892

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Security Bulletin: Multiple Vulnerabilities in IBM Event Processing

Summary IBM Event Processing was affected by multiple vulnerabilities. These are affecting the operator and frontend components. Vulnerability Details CVEID:CVE-2024-55565 DESCRIPTION: nanoid aka Nano ID before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version. CWE:CWE-835: Loop...

MAL-2025-1677 Malicious code in pages14.0.0_i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eaed3f8870b4796bd4fc8667ec8911ddba466acaed945970ce6cf2f67e2630a0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-9358

Name of the Vulnerable Software and Affected Versions Sale with Razorpay versions n/a through 1.0 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. Recommendations For versions n/a through...