Malicious code in @thangved/callback-window (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ed460a227837fd3f7ae156229624e47d46e10b4bca19f0089a29f75c5ca13e09 Any computer that has this package installed or running should be considered fully compromised. All...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. Compromised versions of this package contain a file called bundle.js that exfiltrates secrets from the user's accounts, including credentials and API tokens. It also downloads malicious files and repackages them...

CVE-2025-58764

Claude Code is an agentic coding tool. Due to an error in command parsing, versions prior to 1.0.105 were vulnerable to a bypass of the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claud...

Claude Code rg vulnerability does not protect against approval prompt bypass

Due to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Users on standard Claude Code auto-update will...

CVE-2025-58764

Claude Code is an agentic coding tool. Due to an error in command parsing, versions prior to 1.0.105 were vulnerable to a bypass of the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claud...

CVE-2025-58764 Claude Code rg command had Command Injection that allowed bypass of user approval prompt for command execution

Claude Code is an agentic coding tool. Due to an error in command parsing, versions prior to 1.0.105 were vulnerable to a bypass of the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claud...

Linux Distros Unpatched Vulnerability : CVE-2016-6708

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An elevation of privilege in the System UI in Android 7.0 before 2016-11-01 could enable a local malicious user to bypass the security prompt of your work profi...

Linux Distros Unpatched Vulnerability : CVE-2009-4494

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AOLserver 4.5.1 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibl...

CVE-2025-53801

Untrusted pointer dereference in Windows DWM allows an authorized attacker to elevate privileges locally...

CVE-2025-53801

Untrusted pointer dereference in Windows DWM allows an authorized attacker to elevate privileges locally...

CVE-2025-53801

CVE-2025-53801 is a Windows DWM core library elevation-of-privilege vulnerability described as an untrusted pointer dereference that enables a locally authenticated attacker to achieve elevation of privileges . The CVE is associated with a CVSS v3.1 base score of 7.8 (HIGH) with local attack vect...

CVE-2025-53801 Microsoft DWM Core Library Elevation of Privilege Vulnerability

...

CVE-2025-53801 Microsoft DWM Core Library Elevation of Privilege Vulnerability

...

Microsoft DWM Core Library Elevation of Privilege Vulnerability

Untrusted pointer dereference in Windows DWM allows an authorized attacker to elevate privileges locally...

PT-2025-36824

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: An untrusted pointer dereference in Windows Desktop Window Manager DWM can allow a locally authenticated attacker to gain elevated privileges. This issue allows attackers to affect the...

CVE-2025-48104

Cross-Site Request Forgery CSRF vulnerability in ericzane Floating Window Music Player floating-window-music-player allows Stored XSS.This issue affects Floating Window Music Player: from n/a through = 3.4.2...

CVE-2025-26422

In dump of WindowManagerService.java, there is a possible way of running dumpsys without the required permission due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-26448

In writeToParcel of CursorWindow.cpp, there is a possible out of bounds read due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48104

Cross-Site Request Forgery CSRF vulnerability in ericzane Floating Window Music Player floating-window-music-player allows Stored XSS.This issue affects Floating Window Music Player: from n/a through = 3.4.2...

CVE-2025-48104

CVE-2025-48104 concerns the Floating Window Music Player WordPress plugin. Public documentation confirms a CSRF vulnerability that leads to Stored XSS in versions up to 3.4.2. Affected software: Floating Window Music Player (WordPress plugin). Root cause: Cross-Site Request Forgery enabling store...