Fortinet FortiWeb Unauthenticated RCE

Exploits CVE-2025-64446 auth bypass to create admin account, then uses CVE-2025-58034 command injection via WebSocket CLI for RCE !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.websocketclient import...

CVE-2025-66032: Improper Neutralization of Special Elements used in a Command

Claude Code is an agentic coding tool. Prior to 1.0.93, Due to errors in parsing shell commands related to $IFS and short CLI flags, it was possible to bypass the Claude Code read-only validation and trigger arbitrary code execution. Reliably exploiting this requires the ability to add untrusted...

BIT-FLUX-2022-36035 Flux CLI Workload Injection

Flux is a tool for keeping Kubernetes clusters in sync with sources of configuration like Git repositories, and automating updates to configuration when there is new code to deploy. Flux CLI allows users to deploy Flux components into a Kubernetes cluster via command-line. The vulnerability allow...

Command Injection

Overview caffeinated-whale-cli is an A CLI tool to help manage Frappe Docker instances. Affected versions of this package are vulnerable to Command Injection due to improper validation and sanitization of user-supplied site names and bench path inputs in the unlock command. The command constructs...

Incorrect Default Permissions

Overview caffeinated-whale-cli is an A CLI tool to help manage Frappe Docker instances. Affected versions of this package are vulnerable to Incorrect Default Permissions due to insecure file permissions. The cache directory and database file are created without enforcing restrictive access...

Malicious code in multer-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 653a6b2d3d4620d665c1de60de57e8b94bdc7e3521eb42323c38bd3f5a6c2989 The package multer-cli was found to contain malicious code. Source: ghsa-malware 09308572c706ad725ba1ffe9eba38c5dafc921c2b48e5f8c14e2a2374839e0e5 Any...

cloudmesh-client (>=4.5.0, <=4.7.3), nirum (>=0.0.1, <=0.3.8) +4 more potentially affected by CVE-2025-66221 via werkzeug (0.11.15)

werkzeug PYPI version 0.11.15 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - cloudmesh-client =4.5.0, =0.0.1, =0.4.3, =1.0.0, =0.8.0, =0.1.14, =0.1.20 Source cves: CVE-2025-66221 Source advisory: OSV:GHSA-HGF8-39GV-G3F2...

Malicious code in mongodb-atlas-cli-toc-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b43eaf31369a3ecfac60651fb3c08bc314680fd9b476179d902bbfee64b0d62 The package mongodb-atlas-cli-toc-generator was found to contain malicious code...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. The package was flagged as malicious during the Sha1-hulud supply chain attack. Although the Sha1-hulud IoCs are not present within the package, the contents of the affected version were removed from the officia...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. The package was flagged as malicious during the Sha1-hulud supply chain attack. Although the Sha1-hulud IoCs are not present within the package, the contents of the affected version were removed from the officia...

[SECURITY] Fedora 41 Update: docker-buildx-0.30.1-1.fc41

Docker CLI plugin for extended build capabilities with BuildKit...

org.apache.hive.hcatalog:hive-hcatalog-core (4.1.0), org.apache.hive.hcatalog:hive-hcatalog-pig-adapter (4.1.0) +10 more potentially affected by CVE-2025-62728 via org.apache.hive:hive-metastore (4.1.0)

org.apache.hive:hive-metastore MAVEN version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-metastore and may be impacted: - org.apache.hive.hcatalog:hive-hcatalog-core 4.1.0 -...

[SECURITY] Fedora 42 Update: docker-buildx-0.30.1-1.fc42

Docker CLI plugin for extended build capabilities with BuildKit...

[SECURITY] Fedora 43 Update: docker-buildx-0.30.1-1.fc43

Docker CLI plugin for extended build capabilities with BuildKit...

[SECURITY] Fedora 42 Update: k9s-0.50.16-2.fc42

Kubernetes CLI To Manage Your Clusters In Style!...

EUVD-2025-199455

Malicious code in @pergel/cli npm...

MAL-2025-191284 Malicious code in @pergel/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d52bf0972dc9dad856bf4bc427d7d1bc127b3b0db55ec37a6e1d5327ffe59237 The package @pergel/cli was found to contain malicious code. Source: google-open-source-security...

EUVD-2025-199518

Malicious code in @axinom/mosaic-cli npm...

MAL-2025-191450 Malicious code in @axinom/mosaic-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7168f2a1e0e25128412330dd5022d955509346523f45c453d18e9205eb38b678 The package @axinom/mosaic-cli was found to contain malicious code. Source: ghsa-malware...

Malicious code in @axinom/mosaic-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7168f2a1e0e25128412330dd5022d955509346523f45c453d18e9205eb38b678 The package @axinom/mosaic-cli was found to contain malicious code. Source: ghsa-malware...