15017 matches found
MAL-2025-2348 Malicious code in k8s-deploy-action (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 84c86c15f129692c3b73b16951c9f12754789e3a5ea36e3e5d517e05c7e0231b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2025-21857
In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: fix error handling causing NULL dereference tcfextsmisscookiebasealloc calls xaalloccyclic which can return 1 if the allocation succeeded after wrapping. This was treated as an error, with value 1 returned to...
CVE-2025-0952
CVE-2025-0952 affects the Eco Nature - Environment & Ecology WordPress Theme. A missing capability check on the cmsmasters_hide_admin_notice AJAX action in all versions up to 2.0.4 allows authenticated users with Subscriber+ access to modify options (e.g., setting hide) and potentially cause a de...
MAL-2025-2394 Malicious code in newland-digitization-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 35b5f032125648b5b2cad6fb57b4fcf1c6ab755e93b9ca9640fc85e041bed665 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-2393 Malicious code in newland-component-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a4a9b55a483b5ec495bb5e9c06c5285932e3ff8eb091beee14345f52431123f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-2395 Malicious code in nicegirl (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05d61fc6a090b764666270f91b100bc166fbb85c0227ac947e1bdc876bc8e6a4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-2418 Malicious code in superdope (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9abd6ad5a2ad3503841de7c5ecf7e733d3b98b26b025f093b39f0424bc78fab4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
VulnCheck KEV: CVE-2025-30066
tj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading Github Actions Workflow Logs. These secrets may include, but are not limited to, valid AWS access keys, GitHub personal access tokens PATs, npm...
CVE-2025-1508
The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the downloaddata action in all versions up to, and including, 2.1.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to download...
PT-2025-11694
Name of the Vulnerable Software and Affected Versions reviewdog/action-setup version 1 Description The GitHub Action reviewdog/action-setup was compromised between March 11, 2025, 18:42 and 20:31 UTC with malicious code. This code dumps exposed secrets to GitHub Actions Workflow Logs. Actions tha...
PT-2025-11051
Name of the Vulnerable Software and Affected Versions: Android affected versions not specified Description: The generateFileInfo function within BluetoothOppSendFileInfo.java may allow for cross-user media disclosure due to a confused deputy issue. This could result in local information disclosur...
MAL-2025-2284 Malicious code in valentinesgiftt (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7c3e9e88211b3e2b0dfd9993c04491f26b66cdaece41f1d39f419686829270fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-2280 Malicious code in simple-export-map (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d44defb42445d3a7511f32616401e72a003e6eee8f3e47cd2ca1f41b4026f65b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2025-24451
Substance3D - Painter versions 10.1.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...
The vulnerability of the DNN CMS system, related to the improper implementation of the sequence of actions to be performed, allows a perpetrator to gain unauthorized access to the system’s functions.
The vulnerability of the DNN CMS system is related to the improper implementation of the sequence of actions to be performed. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to the system’s functions...
CVE-2025-27924
Nintex Automation 5.6 and 5.7 before 5.8 has a stored XSS issue associated with the "Navigate to a URL" action...
CVE-2025-27924
Nintex Automation 5.6 and 5.7 before 5.8 has a stored XSS issue associated with the "Navigate to a URL" action...
CVE-2025-27924
CVE-2025-27924 affects Nintex Automation 5.6 and 5.7 prior to 5.8, with a stored XSS in the “Navigate to a URL” action. Impact details per sources indicate a stored cross-site scripting vulnerability, enabling an attacker to inject script via that action. The indicated remediation is to upgrade t...
CVE-2025-0748
CVE-2025-0748 refers to the Homey WordPress theme vulnerability. The Homey theme (WordPress) versions up to and including 2.4.3 are exposed to a Cross-Site Request Forgery (CSRF) due to missing/incorrect nonce validation in the homey_verify_user_manually function. This allows unauthenticated atta...