Malicious code in xo-wallet-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94fd297d5bd2cbf348e88599e570974a4fc9f65f7bf3cdda6bf6a69e8dc8dd44 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in xo-guest-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1517cef9707e50e928c86d5810217ee40f807230a72a4bb77e6b2176fd33ebf0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47365 Malicious code in xo-wallet-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94fd297d5bd2cbf348e88599e570974a4fc9f65f7bf3cdda6bf6a69e8dc8dd44 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

flowise (>=2.0.0, <=2.2.8) potentially affected by unknown CVE via flowise-components (2.2.8)

flowise-components NPM version 2.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on flowise-components and may be impacted: - flowise =2.0.0, =2.2.8 Source cves: unknown CVE Source advisory: SNYK:JS-FLOWISECOMPONENTS-12878598...

Path Traversal

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Path Traversal via improper validation of the user-supplied chatflowid identifier in the addBase64FilesToStorage function. An attacker can access or modify arbitrary files, execute code, or...

Directory Traversal

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Directory Traversal via improper validation of the chatId parameter in the file access process. An attacker can access sensitive files on the server filesystem, including database files...

Arbitrary Code Injection

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Arbitrary Code Injection via the convertToValidJSONString function. An attacker can execute arbitrary JavaScript code with full server privileges by supplying malicious input to the...

flowise (>=2.0.0, <=2.2.8) potentially affected by CVE-2025-59528 via flowise-components (2.2.8)

flowise-components NPM version 2.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on flowise-components and may be impacted: - flowise =2.0.0, =2.2.8 Source cves: CVE-2025-59528 Source advisory: SNYK:JS-FLOWISECOMPONENTS-12818376...

flowise (>=1.6.1, <=2.2.8) potentially affected by CVE-2025-59527 via flowise-components (>=1.8.6, <=2.2.8)

flowise-components NPM version =1.8.6, =1.6.1, =2.2.8 Source cves: CVE-2025-59527 Source advisory: SNYK:JS-FLOWISECOMPONENTS-12840076...

Server-side Request Forgery (SSRF)

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the fetch function in the fetch-links feature when user-supplied URLs are not validated. An attacker can access internal network resources and sensitive...

Arbitrary Code Injection

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Arbitrary Code Injection via the supabaseRPCFilter parameter. An attacker with administrative privileges can execute arbitrary server-side code, access sensitive environment variables, and...

flowise (>=1.6.1, <=2.2.8) potentially affected by unknown CVE via flowise-components (>=1.8.6, <=2.2.8)

flowise-components NPM version =1.8.6, =1.6.1, =2.2.8 Source cves: unknown CVE Source advisory: SNYK:JS-FLOWISECOMPONENTS-12818395...

CVE-2025-10220

Use of Unmaintained Third Party Components CWE-1104 in the NuGet dependency components in AxxonSoft Axxon One VMS 2.0.0 through 2.0.4 on Windows allows a remote attacker to execute arbitrary code or bypass security features via exploitation of vulnerable third-party packages such as...

BIT-NIFI-2023-34212 Apache NiFi: Potential Deserialization of Untrusted Data with JNDI in JMS Components

The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location...

CVE-2025-23343

The NVIDIA NVDebug tool contains a vulnerability that may allow an actor to write files to restricted components. A successful exploit of this vulnerability may lead to information disclosure, denial of service, and data tampering...

DEBIAN-CVE-2025-39739

In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-qcom: Add SM6115 MDSS compatible Add the SM6115 MDSS compatible to clients compatible list, as it also needs that workaround. Without this workaround, for example, QRB4210 RB2 which is based on SM4250/SM6115...

mysql: Components Services unspecified vulnerability (CPU Apr 2025)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Components Services. Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to...

Malicious Package

Overview @navancorp/angular-web-components is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious code in @navancorp/ta-fe-components (npm)

The package @navancorp/ta-fe-components was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ea9ac90aa6a85cd2ff704d7ebf6928a5015a78c68b643de047583737e115a088 Any computer that has this package installed or running should be considered...

MAL-2025-47044 Malicious code in @self-sell/components (npm)

The package @self-sell/components was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aeb15f4ae1c1a830e2fdc21bd8a903fe2e14978eb9952f1e5b3f98f0ca7f353f Any computer that has this package installed or running should be considered fully...