Malicious code in vogue-digital-edition (npm)

The package vogue-digital-edition was found to contain malicious code...

Malicious code in steam-digital-card-card108 (npm)

The package steam-digital-card-card108 was found to contain malicious code...

MAL-2025-7746 Malicious code in @digital-wealth-web/cwp-service-setu (npm)

The package @digital-wealth-web/cwp-service-setu was found to contain malicious code...

MAL-2025-38545 Malicious code in vogue-digital-edition (npm)

The package vogue-digital-edition was found to contain malicious code...

CVE-2025-7774

A security issue exists within the 5032 16pt Digital Configurable module’s web server. Intercepted session credentials can be used within a 3-minute timeout window, allowing unauthorized users to perform privileged actions...

CVE-2025-7773 Rockwell Automation ArmorBlock 5000 I/O – Web Server Vulnerabilities

A security issue exists within the 5032 16pt Digital Configurable module’s web server. The web server’s session number increments at an interval that correlates to the last two consecutive sign in session interval, making it predictable...

CVE-2025-7774

CVE-2025-7774 affects the Rockwell Automation 5032 16pt Digital Configurable module, specifically its web server. The root issue is that intercepted session credentials can be reused within a short 3‑minute timeout window to perform privileged actions. This vulnerability arises from session handl...

CVE-2025-43736

A Denial Of Service via File Upload DOS vulnerability in the Liferay Portal 7.4.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92...

Have You Turned Off Your Virtual Oven?

You check that the windows are shut before leaving home. Return to the kitchen to verify that the oven and stove were definitely turned off. Maybe even circle back again to confirm the front door was properly closed. These automatic safety checks give you peace of mind because you know the unlike...

CVE-2025-49047

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in keeross DigitalOcean Spaces Sync do-spaces-sync allows Stored XSS.This issue affects DigitalOcean Spaces Sync: from n/a through = 2.2.1...

WordPress DigitalOcean Spaces Sync plugin <= 2.2.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nabil Irawan Patchstack Alliance in WordPress Plugin DigitalOcean Spaces Sync versions = 2.2.1...

PT-2025-33276 · Unknown · 5032 16Pt Digital Configurable Module

Name of the Vulnerable Software and Affected Versions: 5032 16pt Digital Configurable module affected versions not specified Description: A security issue exists within the web server of the 5032 16pt Digital Configurable module. Intercepted session credentials can be reused within a 3-minute...

PT-2025-33388 · Unknown · Pareto Digital Embedder For Google Reviews

Name of the Vulnerable Software and Affected Versions: PARETO Digital Embedder for Google Reviews versions n/a through 1.7.3 Description: A missing authorization flaw exists in PARETO Digital Embedder for Google Reviews. This issue allows access to functionality that is not properly constrained b...

Liferay Portal 7.4.x < 7.4.3.132 Cross-Site Scripting

Liferay Portal versions 7.4.x prior to 7.4.3.132 and DXP versions prior to 2024.Q1.13 or 2024.Q2 prior to 2024.Q4.6 are affected by a Cross-Site Scripting allowing an remote non-authenticated attacker to inject JavaScript into the modules/apps/marketplace/marketplace-app-manager-web. No source da...

Liferay Portal 7.4.x < 7.4.3.133 Cross-Site Scripting

Liferay Portal versions 7.4.x prior to 7.4.3.133 and DXP versions prior to 2024.Q1.16 or 2025.Q1.x prior to 2025.Q1.5 or 2025.Q2.x prior to 2025.Q2.0 are affected by a Cross-Site Scripting allowing an remote non-authenticated attacker to inject JavaScript into the...

CVE-2025-43734

Liferay Portal 7.4.0–7.4.3.132 and Liferay DXP 2025.Q1.0–2025.Q1.10, 2024.Q4.0–2024.Q4.7, 2024.Q3.1–2024.Q3.13, 2024.Q2.1–2024.Q2.13, 2024.Q1.1–2024.Q1.16 and 7.4 GA through update 92 are affected by a reflected XSS in the first display label field of a custom sort widget. A remote authenticated ...

GHSA-222W-XMC5-JHP3 Liferay Portal and Liferay DXP have a reflected cross-site scripting vulnerability

A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated...

Liferay Portal and Liferay DXP have a reflected cross-site scripting vulnerability

A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated...

CVE-2025-43735

A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated...

Liferay Portal and Liferay DXP have a Denial Of Service via File Upload (DOS) vulnerability

A Denial Of Service via File Upload DOS vulnerability in Liferay Portal 7.4.3.0 through 7.4.3.132, Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a...