CVE-2025-13644

The CVE-2025-13644 issue affects MongoDB Server and stems from an invariant failure during batched delete operations. The server may misinterpret a batch as containing multiple documents when the document size exceeds BSONObjMaxSize, leading to incorrect handling of the batch. Affected versions i...

CVE-2025-13644 MongoDB may be susceptible to Invariant Failure due to batched delete

MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue arises when the server mistakenly assumes the presence of multiple documents in a batch based solely on document size exceeding BSONObjMaxSize. This issue affects MongoDB Server...

Malicious code in nuxt-keycloak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbb088ab2b0e4b6991065c6bcdc57302ff545bb3fe2f2a73ec21fafeae1175f8 The package nuxt-keycloak was found to contain malicious code. Source: google-open-source-security...

MAL-2025-191249 Malicious code in @oku-ui/arrow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 085e9cbdb891d5b550a81a42584b1cdd8ab001a9443b162158aa633ce18b1e06 The package @oku-ui/arrow was found to contain malicious code. Source: google-open-source-security...

MongoDB -- Reachable Assertion

https://jira.mongodb.org/browse/SERVER-101180 reports: MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue arises when the server mistakenly assumes the presence of multiple documents in a batch based solely on document size...

EUVD-2025-198297

When zx is invoked with --prefer-local=, the CLI creates a symlink named ./nodemodules pointing to /nodemodules. Due to a logic error in src/cli.ts linkNodeModules / cleanup, the function returns the target path instead of the alias symlink path. The later cleanup routine removes what it received...

Malicious code in avminah-affga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80bb68792566e912860c9cb9eea0da3c9449f6980282e1232620c2edad6bee9b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in @miptaa02/dadfia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01c00e54b29699040e7eabcf444c969e1dd6b1f9372a24350ad83163c7e7ea82 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-60675 Malicious code in influential_marmot_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7564b36529d2154534bad26bc3a82d77d69c313fc7715f87f41ac0105d5ee0d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-10124

The Booking Manager WordPress plugin before 2.1.15 registers a shortcode that deletes bookings and makes that shortcode available to anyone with contributor and above privileges. When a page containing the shortcode is visited, the bookings are deleted...

EUVD-2025-33661

The Booking Manager WordPress plugin before 2.1.15 registers a shortcode that deletes bookings and makes that shortcode available to anyone with contributor and above privileges. When a page containing the shortcode is visited, the bookings are deleted...

CVE-2025-10124

The Booking Manager WordPress plugin before 2.1.15 registers a shortcode that deletes bookings and makes that shortcode available to anyone with contributor and above privileges. When a page containing the shortcode is visited, the bookings are deleted...

CVE-2025-10124 Booking Manager < 2.1.15 - Contributor+ Booking Deletion

The Booking Manager WordPress plugin before 2.1.15 registers a shortcode that deletes bookings and makes that shortcode available to anyone with contributor and above privileges. When a page containing the shortcode is visited, the bookings are deleted...

EUVD-2022-34578

Malicious code in bioql PyPI...

EUVD-2024-2960

Malicious code in bioql PyPI...

CVE-2025-32098

CVE-2025-32098 affects Samsung Magician (Windows) versions 6.3–8.3. The root cause is an insecure file-delete operation during the update process, which can allow an attacker to achieve elevation of privilege to SYSTEM . The CVSS v3.1 vector indicates a low attack complexity with no user interact...

Linux Distros Unpatched Vulnerability : CVE-2022-2307

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A lack of cascading deletes in GitLab CE/EE affecting all versions starting from 13.0 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions...

CVE-2022-2307

A lack of cascading deletes in GitLab CE/EE affecting all versions starting from 13.0 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1 allows a malicious Group Owner to retain a usable Group Access Token even after the Group is deleted,...

CVE-2021-35665

Vulnerability in the Hyperion Financial Reporting product of Oracle Hyperion component: Repository. The supported version that is affected is 11.2.6.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Hyperion Financial Reporting...

PT-2025-47992

Name of the Vulnerable Software and Affected Versions MongoDB Server versions prior to 7.0.26 MongoDB Server versions prior to 8.0.13 MongoDB Server versions prior to 8.1.2 Description MongoDB Server may encounter an invariant failure during batched delete operations when processing documents. Th...