Malicious code in src_dev-tool_index_ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6c5f130294b305df1adf1e497c66d81ec09ddeffb8bb6d0c486644336706558 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-FGX4-P8XF-QHP9 Lobe Chat vulnerable to Server-Side Request Forgery with native web fetch module

Vulnerability Description --- Vulnerability Overview - When the client sends an arbitrary URL array and impl: "naive" to the tRPC endpoint tools.search.crawlPages, the server issues outbound HTTP requests directly to those URLs. There is no defensive logic that restricts or validates requests to...

Lobe Chat vulnerable to Server-Side Request Forgery with native web fetch module

Vulnerability Description --- Vulnerability Overview - When the client sends an arbitrary URL array and impl: "naive" to the tRPC endpoint tools.search.crawlPages, the server issues outbound HTTP requests directly to those URLs. There is no defensive logic that restricts or validates requests to...

Malicious code in musl-dev (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 921a96dbb105de30a891a3770c85b1a240ad3625bb52b4e6276340c641b4a46f Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-191650 Malicious code in musl-dev (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 921a96dbb105de30a891a3770c85b1a240ad3625bb52b4e6276340c641b4a46f Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Dev jobs handlebars 安全漏洞

Dev jobs handlebars is a job search program by Felix Individual Developers. A security vulnerability exists in Dev jobs handlebars version 1.0 that stems from the use of an untrusted req.headers.host header to generate an absolute password reset link and force the use of an http scheme, which cou...

CVE-2025-61536: Unverified Password Change

FelixRiddle dev-jobs-handlebars 1.0 uses absolute password-reset magic links using the untrusted req.headers.host header and forces the http:// scheme. An attacker who can control the Host header or exploit a misconfigured proxy/load-balancer that forwards the header unchanged can cause reset lin...

PT-2025-42474

Name of the Vulnerable Software and Affected Versions FelixRiddle dev-jobs-handlebars version 1.0 Description The software uses absolute password-reset links that rely on the untrusted req.headers.host header and enforces the http:// scheme. This allows an attacker who can control the Host header...

Improper Access Control

vite is vulnerable to improper access control. The vulnerability is due to files starting with the same name as those in the public directory being served while bypassing the server.fs settings, which allows an attacker to access restricted files when the Vite dev server is exposed to the network...

The vulnerability of the dev_set_name() function in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the devsetname function in the Linux operating system’s kernel is related to improper memory release before deleting the last reference. Exploiting this vulnerability can allow an attacker to cause a service failure...

EUVD-2025-31840

Successful exploitation of the vulnerability could allow an unauthenticated attacker to gain access to a victim’s Sync account data such as account credentials and email protection information...

EUVD-2025-31843

A security flaw has been discovered in itsourcecode Leave Management System 1.0. This impacts the function redirect of the file /module/employee/controller.php?action=reset of the component Query Parameter Handler. Performing manipulation of the argument ID results in cross site scripting. It is...

Linux Distros Unpatched Vulnerability : CVE-2023-53568

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: don't leak memory if devsetname fails When devsetname fails, zcdncreate doesn't...

Linux Distros Unpatched Vulnerability : CVE-2023-53515

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtio-mmio: don't break lifecycle of vmdev vmdev has a separate lifecycle because it has a 'struct device' embedded. Thus, having a release callback for it is...

Linux Distros Unpatched Vulnerability : CVE-2023-53670

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: nvme-core: fix devpmqos memleak Call devpmqoshidelatencytolerance in the error unwind patch ...

AZL-76404 CVE-2023-53627 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: hisisas: Grab sasdev lock when traversing the members of sasdev.list When freeing slots in function slotcompletev3hw, it is possible that sasdev.list is being traversed elsewhere, and it may trigger a NULL pointer exception...

UBUNTU-CVE-2023-53627

In the Linux kernel, the following vulnerability has been resolved: scsi: hisisas: Grab sasdev lock when traversing the members of sasdev.list When freeing slots in function slotcompletev3hw, it is possible that sasdev.list is being traversed elsewhere, and it may trigger a NULL pointer exception...

UBUNTU-CVE-2023-53670

In the Linux kernel, the following vulnerability has been resolved: nvme-core: fix devpmqos memleak Call devpmqoshidelatencytolerance in the error unwind patch to avoid following kmemleak:- blktests master kmemleak-clear; ./check nvme/044; blktests master kmemleak-scan ; kmemleak-show nvme/044 Te...

CVE-2023-53670 nvme-core: fix dev_pm_qos memleak

In the Linux kernel, the following vulnerability has been resolved: nvme-core: fix devpmqos memleak Call devpmqoshidelatencytolerance in the error unwind patch to avoid following kmemleak:- blktests master kmemleak-clear; ./check nvme/044; blktests master kmemleak-scan ; kmemleak-show nvme/044 Te...

CVE-2023-53670 nvme-core: fix dev_pm_qos memleak

In the Linux kernel, the following vulnerability has been resolved: nvme-core: fix devpmqos memleak Call devpmqoshidelatencytolerance in the error unwind patch to avoid following kmemleak:- blktests master kmemleak-clear; ./check nvme/044; blktests master kmemleak-scan ; kmemleak-show nvme/044 Te...