CVE-2025-12020

The Double the Donation – A workplace giving tool to help your fundraising efforts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.0 due to insufficient input sanitization and output escaping. This makes it possible fo...

EUVD-2025-117442

Malicious code in disabled-apricot-dragon npm...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990779)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990779 advisory. In the Linux kernel, the following vulnerability has been resolved: net: stmmac: Fix zero-division error when disabling tc cbs The commit b8c43360f6e4 net: stmmac: N...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990884)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990884 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Fix null pointer dereference in trace ucsiregisteraltmode checks ISERR for the...

PT-2025-46850

Name of the Vulnerable Software and Affected Versions ZITADEL versions 2.50.0 through 2.71.18 ZITADEL versions 3.0.0-rc.1 through 3.4.3 ZITADEL versions 4.0.0-rc.1 through 4.6.5 Description ZITADEL, an open source identity management platform, has a flaw in its federation process. This issue allo...

EUVD-2025-99773

Malicious code in disabledechidnaz3n npm...

EUVD-2025-105768

Malicious code in disabledrookz3n npm...

kernel: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN

In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Bury Intel PT virtualization guest/host mode behind CONFIGBROKEN Hide KVM's ptmode module param behind CONFIGBROKEN, i.e. disable support for virtualizing Intel PT via guest/host mode unless BROKEN=y. There are myriad...

kernel: acpi: typec: ucsi: Introduce a ->poll_cci method

In the Linux kernel, the following vulnerability has been resolved: acpi: typec: ucsi: Introduce a -pollcci method For the ACPI backend of UCSI the UCSI "registers" are just a memory copy of the register values in an opregion. The ACPI implementation in the BIOS ensures that the opregion contents...

EUVD-2025-74741

Malicious code in disabledminkviolet-71 npm...

EUVD-2025-77088

Malicious code in disabledlandfowl-appteadev npm...

EUVD-2025-82201

Malicious code in disableddormousedumbs npm...

EUVD-2025-82202

Malicious code in disableddamselfly0xrequest npm...

EUVD-2025-70783

Malicious code in disabledblackbirdz3n npm...

EUVD-2025-60965

The Fleet Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and abov...

EUVD-2025-64506

Malicious code in disabledpeafowlz3n npm...

Malicious code in precise_reptile_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57d8c07ce3a237757c323730c463cbf763c952d9f415f299033808db1a63eaa8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-12538

The Fleet Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and abov...

CVE-2025-12019

The Featured Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image metadata in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions an...

Malicious code in zul-klanting54-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4e3b8996018679861b57203818104f479e542996447519ddcd44a99c6a6159f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...