CVE-2025-12155 Command Injection in Looker

A Command Injection vulnerability, resulting from improper file path sanitization Directory Traversal in Looker allows an attacker with Developer permission to execute arbitrary shell commands when a user is deleted on the host system. Looker-hosted and Self-hosted were found to be vulnerable. Th...

MAL-2025-54117 Malicious code in patria-kacang82-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc50fc7cbbd187e227beae59cdb3994e8f37e441f82c013f224a27ed9e0afdb8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in qori-bakwan94-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfdf9cfcd74cd3fe6421457f3a0cbd3733636e82a0aef97764f627317462efdc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-54090 Malicious code in oktafian-telur63-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35122975f1549bde23d98820c8c09450a58c7dd7e216319fa07690d6505aa31b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-53137 Malicious code in kresna-rangginang100-devapp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec8d5eb16c57658f39b8942a122f5bc8511ef9f03abfc8a9898fe25b587289ae This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gita-nasisayur38-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a492550863a563bbd801188f0a1ffa31969ecccad3dbe366d5092986d2591d6f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-51925 Malicious code in galih-getas87-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90927df9d05d864de2327de4433a29ad4e0a0c172acaad3e782cd4fc1fd8e763 The package galih-getas87-ruro was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...

Apple macOS Sequoia Privilege Restriction Insufficiency Vulnerability

Apple macOS Sequoia is an operating system announced by Apple on June 10, 2024 at the WWDC24 developer conference. Apple macOS Sequoia suffers from an insufficient privilege restriction vulnerability that can be exploited by an attacker to cause the disclosure of sensitive user data...

Exploit for CVE-2025-12907

Chrome DevTools RCE Exploit CVE-2025-12907 Overview This...

CVE-2025-12909

Insufficient policy enforcement in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to leak cross-origin data via Devtools. Chromium security severity: Low...

EUVD-2025-38338

Insufficient validation of untrusted input in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to execute arbitrary code via user action in Devtools. Chromium security severity: Low...

PT-2025-45387

Name of the Vulnerable Software and Affected Versions 3scale Developer Portal affected versions not specified Description A flaw exists in the 3scale developer portal that could allow account creation or updates through hidden or read-only fields. This allows an attacker to potentially access or...

CVE-2025-63418

Summary: CVE-2025-63418 affects the SelfBest platform 2023.3. The issue is a DOM-based XSS caused by client-side code performing direct DOM manipulation without adequate sanitization or a CSP. This could allow an attacker to execute arbitrary JavaScript in a logged-in user’s context, potentially ...

CVE-2025-62369 Xibo CMS: Remote Code Execution through module templates

Xibo is an open source digital signage platform with a web content management system CMS. Versions 4.3.0 and below contain a Remote Code Execution vulnerability in the CMS Developer menu's Module Templating functionality, allowing authenticated users with "System - Add/Edit custom modules and...

Xibo CMS 安全漏洞

Xibo CMS is an open source content management system from Xibo Digital Signage. A security vulnerability exists in Xibo CMS 4.3.0 and prior versions, which stems from a mishandled Twig filter in the Module Templates feature in the CMS Developer menu, which could lead to remote code execution...

Important: Red Hat Security Advisory: Red Hat Developer Hub 1.7.2 release.

Red Hat Developer Hub 1.7.2 has been released. Red Hat Developer Hub RHDH is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters AKS, EKS, GKE. The core features of RHDH include a single...

CarLux 安全漏洞

CarLux is a car booking system by the individual developer AKSHIT SONANI. A security vulnerability exists in CarLux version 1.0, which originates from a SQL injection vulnerability in the file /carlux/sign-in.php...

EUVD-2025-37028

Kanova Android App version 1.0.27 package name com.karelane, developed by Karely L.L.C., contains improper access control vulnerabilities. Attackers may gain unauthorized access to user details and obtain group information, including entry codes, by manipulating API request parameters. Successful...

Security Bulletin: IBM watsonx Orchestrate Developer Edition affected by vulnerability in nimbus-jose-jwt

Summary Security Bulletin: IBM watsonx Orchestrate Developer Edition affected by vulnerability in nimbus-jose-jwt Vulnerability Details CVEID:CVE-2025-53864 DESCRIPTION: Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of servic...

Security Bulletin: IBM watsonx Orchestrate Developer Edition affected by vulnerability in multer

Summary Security Bulletin: IBM watsonx Orchestrate Developer Edition affected by vulnerability in multer Vulnerability Details CVEID:CVE-2025-7338 DESCRIPTION: Multer is a node.js middleware for handling multipart/form-data. A vulnerability that is present starting in version 1.4.4-lts.1 and prio...