Amazon Linux 2023 : git, git-all, git-core (ALAS2023-2025-815)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-815 advisory. Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When Git asks for...

CVE-2025-23088

CVE-2025-23088 entry is rejected/not used as stated in the Initial Description.

MAL-2025-234 Malicious code in prombox (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 747f8685d1b7d0c61cf37084a157de813f48b43979c3089b52027da3ace3dbe2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-165 Malicious code in bbc-http-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 607310f08b0c054bccf0fd5902e86de74b458d5c11110bdb411ac30b04c0db95 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-23207

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with renderToString could encounter malicious input using \htmlData that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgrade t...

CVE-2025-23201 Reflected Cross-site Scripting on error alert in librenms

librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to Cross-site Scripting XSS on the parameters:/addhost - param: community. Librenms versions up to 24.10.1 allow remote attackers to inject malicious scripts. When a user views or interacts with th...

CVE-2024-56515

Matrix Media Repo MMR is a highly configurable multi-homeserver media repository for Matrix. If SVG or JPEGXL thumbnailers are enabled they are disabled by default, a user may upload a file which claims to be either of these types and request a thumbnail to invoke a different decoder in...

CVE-2024-52594

Gomatrixserverlib is a Go library for matrix federation. Gomatrixserverlib is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions. The commit c4f1e01 fixes this issue. Users are advised to upgrade. Users unable to upgrade shoul...

CVE-2024-52602 Server-Side Request Forgery (SSRF) on redirects and federation in Matrix Media Repo

Matrix Media Repo MMR is a highly configurable multi-homeserver media repository for Matrix. Matrix Media Repo MMR is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions. This is fixed in MMR v1.3.8. Users are advised to upgrad...

CVE-2024-54142 Cross-site Scripting via Discourse-ai SharedAiConversation onebox in Discourse

Discourse AI is a Discourse plugin which provides a number of AI features. When sharing Discourse AI Bot conversations into posts, if the conversation had HTML entities those could leak into the Discourse application when a user visited a post with a onebox to said conversation. This issue has be...

MAL-2025-95 Malicious code in olivergreen (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 93149667e62337ce494ebf287aeb4ab68a2b6b96fc9d32b5262d381771b539e9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-4458 · Unknown · Convoy Media Category Library

Name of the Vulnerable Software and Affected Versions: Convoy Media Category Library versions n/a through 2.7 Description: The issue affects Convoy Media Category Library, allowing Reflected XSS due to improper neutralization of input during web page generation. This is a type of Cross-site...

Aggregators of actively discussed vulnerabilities

Aggregators of actively discussed vulnerabilities. Alexander Redchits updated his list of services that highlight TOP CVE vulnerabilities and uploaded it with descriptions to teletype in Russian. Now there are 11 of them: 1. Intruder's Top CVE Trends & Expert Vulnerability Insights 2. Cytidel Top...

PT-2025-1937 · WordPress · Asgard Security Scanner

Name of the Vulnerable Software and Affected Versions: Asgard Security Scanner WordPress plugin versions 0.7 and earlier Description: The issue arises from the plugin not sanitizing and escaping a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. This...

PT-2025-2046

Name of the Vulnerable Software and Affected Versions MicroWorld eScan Antivirus version 7.0.32 Description A critical issue affects some unknown functionality of the file /opt/MicroWorld/var/ of the component Installation Handler, leading to incorrect default permissions. The attack must be...

Mozilla Firefox ESR Security Update (MFSA2024-40) - Mac OS X

Firefox ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefoxesr";...

DEBIAN-CVE-2024-56644

In the Linux kernel, the following vulnerability has been resolved: net/ipv6: release expired exception dst cached in socket Dst objects get leaked in ip6negativeadvice when this function is executed for an expired IPv6 route located in the exception table. There are several conditions that must ...

BIT-DISCOURSE-2024-52794 Magnific lightbox susceptible to Cross-site Scripting in Discourse

Discourse is an open source platform for community discussion. Users clicking on the lightbox thumbnails could be affected. This problem is patched in the latest version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability...

BIT-DISCOURSE-2024-53991 Potential Backup file leaked via Nginx in Discourse

Discourse is an open source platform for community discussion. This vulnerability only impacts Discourse instances configured to use FileStore::LocalStore which means uploads and backups are stored locally on disk. If an attacker knows the name of the Discourse backup file, the attacker can trick...

CVE-2024-56359

grist-core is a spreadsheet hosting server. A user visiting a malicious document and clicking on a link in a HyperLink cell using a control modifier meaning for example Ctrl+click could have their account compromised, since the link could use the javascript: scheme and be evaluated in the context...