MAL-2025-19830 Malicious code in eslint-config-googlejs-es6 (npm)

The package eslint-config-googlejs-es6 was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 8940b7796dc2789fa52ad6b2bff9f902eabc3c074e0146ffa0bf81789cc1d365 This package installs a dependency hosted on a custom domain...

MAL-2025-14189 Malicious code in airbnb-flow (npm)

The package airbnb-flow was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: google-open-source-security cf721a7ab34d44cd6e6bd7fa345aa5926234cdaa069ab71e315ee5780227c2b2 This package installs a dependency hosted on a custom domain that runs an inf...

Malicious code in vue-custom-directives (npm)

The package vue-custom-directives was found to contain malicious code...

Malicious code in react-airbnb-prettier (npm)

The package react-airbnb-prettier was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 8dfaae080b90705a47740e1ced1edacf0110db947f0f26fdd35e2805a2886d37 This package installs a dependency hosted on a custom domain that...

Malicious code in custom-redis (npm)

The package custom-redis was found to contain malicious code...

Malicious code in valvo-custom-bs (npm)

The package valvo-custom-bs was found to contain malicious code...

MAL-2025-17833 Malicious code in custom-get-org-chart (npm)

The package custom-get-org-chart was found to contain malicious code...

MAL-2025-19031 Malicious code in dynamic-import-webpack (npm)

The package dynamic-import-webpack was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 6f9cf66ec7ebae846d89e7ce18fbdb1318e4cd99bf61c0e719bd78ce8c6aabe1 This package installs a dependency hosted on a custom domain that...

MAL-2025-17835 Malicious code in custom-property-analyzer (npm)

The package custom-property-analyzer was found to contain malicious code...

MAL-2025-14193 Malicious code in airbnb-lite (npm)

The package airbnb-lite was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 156283cf217f6dbaa79bc5dfcccb51a8febb9f4a1c0bdaee10e0b65dbae8a32c This package installs a dependency hosted on a custom domain that runs an inf...

MAL-2025-38668 Malicious code in vue-custom-directives (npm)

The package vue-custom-directives was found to contain malicious code...

httpd: insufficient escaping of user-supplied data in mod_ssl

A vulnerability was found in the Apache HTTP Server. Insufficient escaping of user-supplied data in modssl allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%varnamex" or "%varnamec" to...

httpd: insufficient escaping of user-supplied data in mod_ssl

A vulnerability was found in the Apache HTTP Server. Insufficient escaping of user-supplied data in modssl allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%varnamex" or "%varnamec" to...

WordPress Add Custom Codes <= 4.80 - Arbitrary Code Execution Vulnerability

Arbitrary Code Execution Vulnerability discovered by Ryan Novotny in WordPress Plugin Add Custom Codes versions = 4.80...

CVE-2025-28975

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in redqteam Alike - WordPress Custom Post Comparison alike allows Reflected XSS.This issue affects Alike - WordPress Custom Post Comparison: from n/a through = 3.0.1...

Command Injection

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Command Injection via the CustomMCP class. An attacker can gain unauthorized remote access and execute arbitrary operating system commands by sending crafted requests over the network. This i...

CVE-2025-28975

CVE-2025-28975 corresponds to a WordPress plugin vulnerability in the Alike – WordPress Custom Post Comparison extension. The issue is a reflected Cross‑Site Scripting (XSS) flaw caused by improper neutralization of user input during web page generation, affecting versions up to and including 3.0...

CVE-2025-28975 WordPress Alike - WordPress Custom Post Comparison <= 3.0.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in redqteam Alike - WordPress Custom Post Comparison allows Reflected XSS. This issue affects Alike - WordPress Custom Post Comparison: from n/a through 3.0.1...

CVE-2025-28975 WordPress Alike - WordPress Custom Post Comparison <= 3.0.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in redqteam Alike - WordPress Custom Post Comparison alike allows Reflected XSS.This issue affects Alike - WordPress Custom Post Comparison: from n/a through = 3.0.1...

CVE-2025-8943 Unsupervised OS command execution leads to remote code execution by unauthenticated network attackers

The Custom MCPs feature is designed to execute OS commands, for instance, using tools like npx to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls RBAC. Furthermore, in Flowise versions before 3.0.1 the...