Linux Distros Unpatched Vulnerability : CVE-2024-25583

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A crafted response from an upstream server the recursor has been configured to forward-recurse to can cause a Denial of Service in the Recursor. The default...

MAL-2025-18178 Malicious code in default-debug (npm)

The package default-debug was found to contain malicious code...

Malicious code in nextjs-default (npm)

The package nextjs-default was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...

Malicious code in default-debug (npm)

The package default-debug was found to contain malicious code...

MAL-2025-38509 Malicious code in vite-default (npm)

The package vite-default was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...

Malicious code in vite-default (npm)

The package vite-default was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...

brick (0.0.0), brick-node (>=0.0.8, <=0.0.17) +20 more potentially affected by unknown CVE via default-debug (>=0.0.0, <=2.0.0)

default-debug NPM version =0.0.0, =0.0.8, =0.0.0, =0.0.0, =0.0.0, =0.0.0, =0.0.5 and more Source cves: unknown CVE Source advisory: OSV:MAL-2025-18178...

MAL-2025-27402 Malicious code in nextjs-default (npm)

The package nextjs-default was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...

CVE-2025-27559

Incorrect default permissions for some AI Playground software before version v2.3.0 alpha may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2025-20023

Incorrect default permissions for some IntelR Graphics Driver software installers may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2025-26470

Incorrect default permissions for some IntelR Distribution for Python software installers before version 2025.1.0 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2025-8452

By using the "uscan" protocol provided by the eSCL specification, an attacker can discover the serial number of multi-function printers that implement the Brother-provided firmware. This serial number can, in turn, can be leveraged by the flaw described by CVE-2024-51978 to calculate the default...

GHSA-2VV2-3X8X-4GV7 Flowise OS command remote code execution

The Custom MCPs feature is designed to execute OS commands, for instance, using tools like npx to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls RBAC. Furthermore, in Flowise versions before 3.0.1 the...

CVE-2025-8943

Flowise CVE-2025-8943 affects Flowise versions before 3.0.1. The vulnerability resides in the Custom MCPs feature, specifically the /api/v1/node-load-method/customMCP endpoint, where insufficient authentication/authorization allows unauthenticated network attackers to execute OS commands unsandbo...

CVE-2025-8943 Unsupervised OS command execution leads to remote code execution by unauthenticated network attackers

The Custom MCPs feature is designed to execute OS commands, for instance, using tools like npx to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls RBAC. Furthermore, in Flowise versions before 3.0.1 the...

CVE-2025-54472 Apache bRPC: Redis Parser Remote Denial of Service

Unlimited memory allocation in redis protocol parser in Apache bRPC all versions 1.14.1 on all platforms allows attackers to crash the service via network. Root Cause: In the bRPC Redis protocol parser code, memory for arrays or strings of corresponding sizes is allocated based on the integers re...

CVE-2025-54472

CVE-2025-54472 affects Apache bRPC’s Redis protocol parser. The root cause is unbounded memory allocation when parsing Redis protocol data, where arrays/strings are allocated based on network-provided integers; if a value is too large, a bad_alloc can crash the service. The issue also affects 1.1...

CVE-2025-54472 Apache bRPC: Redis Parser Remote Denial of Service

Unlimited memory allocation in redis protocol parser in Apache bRPC all versions 1.14.1 on all platforms allows attackers to crash the service via network. Root Cause: In the bRPC Redis protocol parser code, memory for arrays or strings of corresponding sizes is allocated based on the integers re...

Active Storage allowed transformation methods that were potentially unsafe

Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters by default. The default allowed list contains three methods allowing for the circumvention of the safe defaults which enables potential command injection vulnerabilities in cases where...

Flowise 安全漏洞

Flowise is a FlowiseAI open source tool for easily building LLM applications. A security vulnerability exists in versions prior to Flowise 3.0.1 that stems from the lack of authentication and role-based access control in the default installation, which could lead to the execution of un-sandboxed ...