Malicious code in demo-vault-backup-webapp (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-6281 Malicious code in demo-vault-backup-webapp (npm)

The package communicates with a domain associated with malicious activity...

org.apache.jackrabbit:jackrabbit-jca (>=2.23.0-beta, <=2.23.1-beta), org.apache.jackrabbit:jackrabbit-standalone-components (>=2.23.0-beta, <=2.23.1-beta) +2 more potentially affected by CVE-2025-53689 via org.apache.jackrabbit:jackrabbit-core (>=2.23.0-beta, <=2.23.1-beta)

org.apache.jackrabbit:jackrabbit-core MAVEN version =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.1-beta Source cves: CVE-2025-53689 Source advisory: OSV:GHSA-44C3-38H8-9FH9...

Security update for tomcat

This update for tomcat fixes the following issues: CVE-2025-46701: Fixed refactor CGI servlet to access resources via WebResources bsc1243815. CVE-2025-48988: Fixed limits the total number of parts in a multi-part request and limits the size of the headers provided with each part bsc1244656...

de.digitalcollections.cudami:dc-cudami-admin-webapp (>=7.0.0-rc1, <=8.0.3), io.github.dbmdz.cudami:cudami (>=9.0.0, <=11.0.0) +6 more potentially affected by CVE-2026-2327 via org.webjars.npm:markdown-it (>=13.0.2, <=14.3.0)

org.webjars.npm:markdown-it MAVEN version =13.0.2, =7.0.0-rc1, =9.0.0, =0.35.4, =3.13.0, =1.10.1, =2.0.3, =3.10.2 - org.webjars.npm:tiptapstarter-kit 3.10.2 Source cves: CVE-2026-2327 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15282866...

autoreduce-db (>=0.1.0, <=22.0.0.dev1), autoreduce-frontend (>=21.1.1, <=21.1.3) +4 more potentially affected by CVE-2025-48432 via django (3.2.2)

django PYPI version 3.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - autoreduce-db =0.1.0, =21.1.1, =21.1.0, =22.0.0.dev0, =21.1.2, =21.1.4 Source cves: CVE-2025-48432 Source advisory: OSV:GHSA-7XR5-9HCQ-CHF9...

org.glassfish.jersey.bundles.glassfish.v4_0:jersey-gfv4_0-core (2.0-rc1), org.glassfish.jersey.examples:bean-validation-webapp (2.0-rc1) +1 more potentially affected by CVE-2025-35036 via org.hibernate:hibernate-validator (5.0.0.cr4)

org.hibernate:hibernate-validator MAVEN version 5.0.0.cr4 is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate:hibernate-validator and may be impacted: - org.glassfish.jersey.bundles.glassfish.v40:jersey-gfv40-core 2.0-rc1 -...

CVE-2025-48066

wire-webapp is the web application for the open-source messaging service Wire. A bug fix caused a regression causing an issue with function to delete local data. Instructing the client to delete its local database on user logout does not result in deletion. This is the case for both temporary...

CVE-2025-48061

wire-webapp is the web application for the open-source messaging service Wire. A change caused a regression resulting in sessions not being properly invalidated. A user that logged out of the Wire webapp, could have been automatically logged in again after re-opening the application. This does no...

CVE-2022-22821

NVIDIA NeMo before 1.6.0 contains a vulnerability in ASR WebApp, in which ../ Path Traversal may lead to deletion of any directory when admin privileges are available...

CVE-2021-21400

wire-webapp is an open-source front end for Wire, a secure collaboration platform. In wire-webapp before version 2021-03-15-production.0, when being prompted to enter the app-lock passphrase, the typed passphrase will be sent into the most recently used chat when the user does not actively give...

CVE-2021-32683

wire-webapp is the web version of Wire, an open-source messenger. A cross-site scripting vulnerability exists in wire-webapp prior to version 2021-06-01-production.0. If a user is instructed to open an image in a new tab right click - open in new tab, or copy the URL and paste it in the URL bar, ...

CVE-2025-48066 wire-webapp has no database deletion on client logout

wire-webapp is the web application for the open-source messaging service Wire. A bug fix caused a regression causing an issue with function to delete local data. Instructing the client to delete its local database on user logout does not result in deletion. This is the case for both temporary...

CVE-2025-48066 wire-webapp has no database deletion on client logout

wire-webapp is the web application for the open-source messaging service Wire. A bug fix caused a regression causing an issue with function to delete local data. Instructing the client to delete its local database on user logout does not result in deletion. This is the case for both temporary...

CVE-2025-48061

wire-webapp is the web application for the open-source messaging service Wire. A change caused a regression resulting in sessions not being properly invalidated. A user that logged out of the Wire webapp, could have been automatically logged in again after re-opening the application. This does no...

CVE-2025-48061

CVE-2025-48061 affects the wire-webapp (Wire) web client. A regression in the session invalidation process allowed a user who logged out to be automatically re-authenticated when re-opening the app. This issue is present in versions up to but not including 2025-05-20-production.0; the underlying ...

CVE-2025-48061 wire-webapp Has Insufficient Session Invalidation after User Logout

wire-webapp is the web application for the open-source messaging service Wire. A change caused a regression resulting in sessions not being properly invalidated. A user that logged out of the Wire webapp, could have been automatically logged in again after re-opening the application. This does no...

CVE-2025-48061 wire-webapp Has Insufficient Session Invalidation after User Logout

wire-webapp is the web application for the open-source messaging service Wire. A change caused a regression resulting in sessions not being properly invalidated. A user that logged out of the Wire webapp, could have been automatically logged in again after re-opening the application. This does no...

CVE-2025-48061 wire-webapp Has Insufficient Session Invalidation after User Logout

wire-webapp is the web application for the open-source messaging service Wire. A change caused a regression resulting in sessions not being properly invalidated. A user that logged out of the Wire webapp, could have been automatically logged in again after re-opening the application. This does no...

CVE-2020-26954

When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on...