MAL-2025-36272 Malicious code in test-mlw2-snits-block (npm)

The package test-mlw2-snits-block was found to contain malicious code...

Malicious code in planett-simple-ad-block (npm)

The package planett-simple-ad-block was found to contain malicious code...

Malicious code in test-mlw2-snits-block (npm)

The package test-mlw2-snits-block was found to contain malicious code...

Malicious code in block-pattern-explorer (npm)

The package block-pattern-explorer was found to contain malicious code...

Malicious code in block-chain (npm)

The package block-chain was found to contain malicious code...

MAL-2025-29369 Malicious code in planett-simple-ad-block (npm)

The package planett-simple-ad-block was found to contain malicious code...

MAL-2025-15826 Malicious code in block-chain (npm)

The package block-chain was found to contain malicious code...

MAL-2025-41098 Malicious code in zucchini-blk-project (npm)

The package zucchini-blk-project was found to contain malicious code...

MAL-2025-15827 Malicious code in block-pattern-explorer (npm)

The package block-pattern-explorer was found to contain malicious code...

CVE-2025-50169

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows SMB allows an unauthorized attacker to execute code over a network...

CVE-2025-55192 HomeAssistant-Tapo-Control Code Injection Vulnerability in issues.yml Workflow

HomeAssistant-Tapo-Control offers Control for Tapo cameras as a Home Assistant component. Prior to commit 2a3b80f, there is a code injection vulnerability in the GitHub Actions workflow .github/workflows/issues.yml. It does not affect users of the Home Assistant integration itself — it only impac...

CVE-2025-55192

HomeAssistant-Tapo-Control exposes a code injection vulnerability in its GitHub Actions workflow .github/workflows/issues.yml, prior to commit 2a3b80f. The workflow directly inserts user-controlled content from the issue body (github.event.issue.body) into a Bash conditional without proper saniti...

CVE-2025-55674 Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions

A bypass of the DISALLOWEDSQLFUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leadi...

CVE-2025-55674 Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions

A bypass of the DISALLOWEDSQLFUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leadi...

CVE-2025-54694

Cross-Site Request Forgery CSRF vulnerability in bPlugins Button Block button-block allows Cross Site Request Forgery.This issue affects Button Block: from n/a through = 1.2.0...

CVE-2025-54693

Unrestricted Upload of File with Dangerous Type vulnerability in epiphyt Form Block form-block allows Upload a Web Shell to a Web Server.This issue affects Form Block: from n/a through = 1.5.5...

CVE-2025-54694 WordPress Button Block Plugin plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in bPlugins Button Block allows Cross Site Request Forgery. This issue affects Button Block: from n/a through 1.2.0...

CVE-2025-54694

CVE-2025-54694 describes a Cross-Site Request Forgery in the WordPress plugin Button Block, affecting versions up to 1.2.0. The issue is confirmed in multiple sources and the CVE record shows a patch that updates beyond 1.2.0. Base metrics: CVSS v3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N wit...

CVE-2025-54694 WordPress Button Block Plugin plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in bPlugins Button Block button-block allows Cross Site Request Forgery.This issue affects Button Block: from n/a through = 1.2.0...

CVE-2025-54693

CVE-2025-54693 describes an Unrestricted Upload of File with Dangerous Type vulnerability in WordPress Form Block Plugin 1.5.5). CVSSv3 data cited in the initial record indicates a Critical impact (9.0 base score) with network attack vector, high complexity, no privileges required, and CHANGED sc...