Malicious code in fxa-setting (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f974a3b678356e1d011ca08a0cb13eaec2f69e2d5ca4056fbfabf9a2864156eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in airbnb-javascript (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a1d7d33c25e202a6ad49fb54065863092fb024863cb59952744ea002c333bab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

VulnCheck KEV: CVE-2025-41646

An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion. This leads to full compromise of the device...

Malicious code in jsonloggers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d54b4c8a926e93beec48e7aeb67936e9095d34e48f015fc167af0fa33e11574e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @cpce/console-sub-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f0e227ba31b179597ff26830a069bf360d8ce9ea5fe6ec81f517bd159dbb5d10 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in symphony-cryptolib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c8216b9fdde76a4f40936fd19fbe9a3a7d73dcf66ffdde04c6cf54ee965448b9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in netnodepushlab (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8075dc70312aef2a7a748bce4eb98bff84e4f8cc1d9c992f14446a257cf8e319 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in css-keylogger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d7d5c0eac76577da5186e985efd72018e773d9ada891e44852188b9e5cd8632 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in androidvoues (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7910b042dc0dd8ec99a4c7b8c717ff9f7f3a83ccae6ae30d9baa4e9019d30c39 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in appf-react-router-dom (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bee107551e93c84b7b5e64794220ddf4898466e42cd01d1bdde8b41bb0cabd83 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in product_card_grid (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7cff91597e126b61f1bb6911119a35d329959dadbfee0c086ccd4c7d79bf2ca7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in data-formatter-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e0dd2a4d0c8101cf1e6761361aea7bc9afd9d28010878e44622da7af6fa3dfd7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in r6-info.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d5776f3141e453fa085c2ea81f617610e3243fa733cbd8f54d01864a57e54247 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-34043

A remote command injection vulnerability exists in Vacron Network Video Recorder NVR devices v1.4 due to improper input sanitization in the board.cgi script. The vulnerability allows unauthenticated attackers to pass arbitrary commands to the underlying operating system via crafted HTTP requests...

CVE-2025-5828

Autel MaxiCharger AC Wallbox Commercial wLength Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is not required to...

Malicious code in nordic-dev-ts (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1745e8aa07b56cf04bc594aa60fb250b98666d7c3c65514c610e4e55b39ec70f Any computer that has this package installed or running should be considered...

CVE-2025-34043

A remote command injection vulnerability exists in Vacron Network Video Recorder NVR devices v1.4 due to improper input sanitization in the board.cgi script. The vulnerability allows unauthenticated attackers to pass arbitrary commands to the underlying operating system via crafted HTTP requests...

CVE-2025-34043 Vacron NVR Remote Command Execution

A remote command injection vulnerability exists in Vacron Network Video Recorder NVR devices v1.4 due to improper input sanitization in the board.cgi script. The vulnerability allows unauthenticated attackers to pass arbitrary commands to the underlying operating system via crafted HTTP requests...

CVE-2025-34043 Vacron NVR Remote Command Execution

A remote command injection vulnerability exists in Vacron Network Video Recorder NVR devices v1.4 due to improper input sanitization in the board.cgi script. The vulnerability allows unauthenticated attackers to pass arbitrary commands to the underlying operating system via crafted HTTP requests...

New Android Malware Surge Hits Devices via Overlays, Virtualization Fraud, and NFC Theft

Cybersecurity researchers have exposed the inner workings of an Android malware called AntiDot that has compromised over 3,775 devices as part of 273 unique campaigns. "Operated by the financially motivated threat actor LARVA-398, AntiDot is actively sold as a Malware-as-a-Service MaaS on...