CVE-2025-64507 Incus vulnerable to local privilege escalation through custom storage volumes

Incus is a system container and virtual machine manager. An issue in versions prior to 6.0.6 and 6.19.0 affects any Incus user in an environment where an unprivileged user may have root access to a container with an attached custom storage volume that has the security.shifted property set to true...

CVE-2025-64507

CVE-2025-64507 affects Incus/LXD: in versions prior to 6.0.6 and 6.19.0 an unprivileged user who can access a container and a host with a custom storage volume that has security.shifted=true may create a setuid binary inside the container and execute it on the host to gain root. The issue require...

CVE-2025-64507 Incus vulnerable to local privilege escalation through custom storage volumes

Incus is a system container and virtual machine manager. An issue in versions prior to 6.0.6 and 6.19.0 affects any Incus user in an environment where an unprivileged user may have root access to a container with an attached custom storage volume that has the security.shifted property set to true...

CVE-2025-64507 Incus vulnerable to local privilege escalation through custom storage volumes

Incus is a system container and virtual machine manager. An issue in versions prior to 6.0.6 and 6.19.0 affects any Incus user in an environment where an unprivileged user may have root access to a container with an attached custom storage volume that has the security.shifted property set to true...

Malicious code in ogi-nasicampur7-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26c5d91ee0a7f4166e06054f3607ba5569182384856fc75f2313ceba83024f40 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-57861 Malicious code in nursing_snake_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b3fc15027f38198dfd98d1a2abaee3feba914c62166ba6f51e42e8b4e847bcc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

WordPress Custom Fields Account Registration For Woocommerce plugin <= 1.2 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Denver Jackson in WordPress Plugin Custom Fields Account Registration For Woocommerce versions = 1.2...

Linux Distros Unpatched Vulnerability : CVE-2025-64507

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incus is a system container and virtual machine manager. An issue in versions prior to 6.0.6 and 6.19.0 affects any Incus user in an environment where an...

PT-2025-46210

Name of the Vulnerable Software and Affected Versions Incus versions prior to 6.0.6 and 6.19.0 LXD versions prior to 5.0.2-5+deb12u2 Incus versions prior to 6.0.4-2+deb13u2 Description Incus, a system container and virtual machine manager, has a flaw that could allow local privilege escalation...

CVE-2025-11980

The Quick Featured Images plugin for WordPress is vulnerable to SQL Injection via the 'deleteorphaned' function in all versions up to, and including, 13.7.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

EUVD-2025-38368

Malicious code in focusync-custom-controls npm...

MAL-2025-49392 Malicious code in focusync-custom-controls (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83979de8b383c0a28ec2fea476c2842bafabcb6e5abfe06e4253a9c1ab713234 The package focusync-custom-controls was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in focusync-custom-controls (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83979de8b383c0a28ec2fea476c2842bafabcb6e5abfe06e4253a9c1ab713234 The package focusync-custom-controls was found to contain malicious code. Source: ossf-package-analysis...

CVE-2025-63713

Cross-Site Scripting XSS vulnerability in SourceCodester "MatchMaster" 1.0 allows remote attackers to inject arbitrary web script or HTML via crafted input in the custom test creation feature. The vulnerability exists because the application fails to properly sanitize user-supplied input in test...

PT-2026-2655

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 144.0.7559.59 Description: A flaw exists in the V8 JavaScript engine within Google Chrome. This issue involves an out-of-bounds memory access, potentially allowing a remote attacker to execute arbitrary code or...

EUVD-2025-38259

Cross-Site Scripting XSS vulnerability in SourceCodester "MatchMaster" 1.0 allows remote attackers to inject arbitrary web script or HTML via crafted input in the custom test creation feature. The vulnerability exists because the application fails to properly sanitize user-supplied input in test...

CVE-2025-60207

Unrestricted Upload of File with Dangerous Type vulnerability in Addify Custom User Registration Fields for WooCommerce user-registration-plugin-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects Custom User Registration Fields for WooCommerce: from n/a through = 2.1.2...

CVE-2025-64224

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeGoods Grand Conference Theme Custom Post Type grandconference-custom-post allows Reflected XSS.This issue affects Grand Conference Theme Custom Post Type: from n/a through 2.6.4...

Incorrect Behavior Order

Overview ai is an AI SDK by Vercel - The AI Toolkit for TypeScript and JavaScript Affected versions of this package are vulnerable to Incorrect Behavior Order via the downloadAssets function. An attacker can upload files with disallowed types by substituting arbitrary downloaded bytes for differe...

CVE-2025-64114

ClipBucket v5 is an open source video sharing platform. Versions 5.5.2 - 151 and below allow authenticated administrators with plugin management privileges to execute arbitrary SQL commands against the database through its ClipBucket Custom Fields plugin. The vulnerabilities require the Custom...