CVE-2025-46776

Summary (CVE-2025-46776) Fortinet FortiExtender is affected by a buffer copy without input size validation, enabling an authenticated user to execute arbitrary code or commands via crafted CLI commands. Affected versions include FortiExtender 7.6.0–7.6.1, 7.4.0–7.4.6, 7.2 all versions, and 7.0 al...

CVE-2025-58034

CVE-2025-58034 — Fortinet FortiWeb OS Command Injection occurs in FortiWeb 8.0.0–8.0.1, 7.6.0–7.6.5, 7.4.0–7.4.10, 7.2.0–7.2.11, 7.0.0–7.0.11. The flaw is an OS command injection (CWE-78) allowing an authenticated attacker to execute arbitrary commands on the underlying system via crafted HTTP re...

CVE-2025-58034

An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability CWE-78 vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may...

CVE-2025-46776: Buffer Copy without Checking Size of Input

A buffer copy without checking size of input 'classic buffer overflow' vulnerability in Fortinet FortiExtender 7.6.0 through 7.6.1, FortiExtender 7.4.0 through 7.4.6, FortiExtender 7.2 all versions, FortiExtender 7.0 all versions may allow an authenticated user to execute arbitrary code or comman...

CVE-2025-54821: Improper Privilege Management

An Improper Privilege Management vulnerability CWE-269 vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.11, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.6.0, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM...

PT-2025-47358

Name of the Vulnerable Software and Affected Versions Fortinet FortiOS versions 6.4 through 7.6.3 Fortinet FortiPAM versions 1.0 through 1.6.0 Fortinet FortiProxy versions 7.0 through 7.6.3 Description An Improper Privilege Management issue exists that may allow an authenticated administrator to...

Authenticated CLI Commands Buffer Overflow

A buffer overflow vulnerability CWE-120 in FortiExtender jsoncli may allow an authenticated user to execute arbitrary code or commands via crafted CLI commands...

Trusted hosts bypass via SSH

An Improper Privilege Management vulnerability CWE-269 in FortiOS, FortiProxy and FortiPAM may allow an authenticated administrator to bypass the trusted host policy via crafted CLI command...

CVE-2025-58034: Improper Neutralization of Special Elements used in an OS Command

An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability CWE-78 vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may...

CVE-2025-64756

Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files with malicious names. When glob -c are...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection in the CLI, via the -c/--cmd option. The processing of commandline options in src/bin.mts calls the foregroundChild on them, which defaults to setting shell: true. An attacker who can control the filenames being matche...

CVE-2025-64756

Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files with malicious names. When glob -c are...

CVE-2025-64756 glob CLI: Command injection via -c/--cmd executes matches with shell:true

Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files with malicious names. When glob -c are...

CVE-2025-64756 glob CLI: Command injection via -c/--cmd executes matches with shell:true

Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files with malicious names. When glob -c are...

CVE-2025-64756 glob CLI: Command injection via -c/--cmd executes matches with shell:true

Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files with malicious names. When glob -c are...

arakawa (0.1.0-alpha.1), vega-cli (>=6.0.0, <=6.1.2) potentially affected by CVE-2025-59840 via vega (>=6.0.0, <=6.1.2)

vega NPM version =6.0.0, =6.0.0, =6.1.2 Source cves: CVE-2025-59840 Source advisory: OSV:GHSA-7F2V-3QQ3-VVJF...

@omni-co/vega-lite (>=6.2.0-fork.2, <=6.2.0-fork.2-beta.2), arakawa (0.1.0-alpha.1) +3 more potentially affected by CVE-2025-59840 via vega-expression (6.0.0)

vega-expression NPM version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on vega-expression and may be impacted: - @omni-co/vega-lite =6.2.0-fork.2, =6.0.0, =6.0.0, =6.0.0, =6.3.1 Source cves: CVE-2025-59840 Source advisory: GHSA-7F2V-3QQ3-VVJF...

arakawa (0.1.0-alpha.1), vega-cli (>=6.0.0, <=6.1.2) potentially affected by CVE-2025-59840 via vega (>=6.0.0, <=6.1.2)

vega NPM version =6.0.0, =6.0.0, =6.1.2 Source cves: CVE-2025-59840 Source advisory: SNYK:JS-VEGA-13961123...

@omni-co/vega-lite (>=6.2.0-fork.2, <=6.2.0-fork.2-beta.2), arakawa (0.1.0-alpha.1) +3 more potentially affected by CVE-2025-59840 via vega-expression (6.0.0)

vega-expression NPM version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on vega-expression and may be impacted: - @omni-co/vega-lite =6.2.0-fork.2, =6.0.0, =6.0.0, =6.0.0, =6.3.1 Source cves: CVE-2025-59840 Source advisory:...

Malicious code in centauri-cli-transport-selenium (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd6ea24fbeeee105ca193a62e5857465b996bac0d4c5b8f72086246e1f61c665 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...