CVE-2025-13204

The expr-eval and expr-eval-fork npm packages are vulnerable to Prototype Pollution due to improper handling of JavaScript prototype-based inheritance in the eval interface . An attacker with access to the express eval interface can exploit this flaw to achieve arbitrary code execution . This vul...

EUVD-2025-197614

npm package expr-eval is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolves this issue...

CVE-2025-62484

Inefficient regular expression complexity in certain Zoom Workplace Clients before version 6.5.10 may allow an unauthenticated user to conduct an escalation of privilege via network access...

netfilter: nft_objref: validate objref and objrefmap expressions

...

JavaScript Expression Evaluator security vulnerability

JavaScript Expression Evaluator is a math calculator by Matthew Crumley Personal Developer. A security vulnerability exists in JavaScript Expression Evaluator that stems from prototype contamination and could lead to the execution of arbitrary code...

MGASA-2025-0290 Updated ruby packages fix security vulnerabilities

Net::IMAP vulnerable to possible DoS by memory exhaustion. CVE-2025-25186 In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service DoS vulnerability. The method does not impose any limit on the length of the raw cookie value it...

@0xgg/echomd (>=1.0.2, <=1.0.4), @ajuhos/malloy-tests (>=0.0.332, <=0.0.334) +179 more potentially affected by CVE-2025-59840 via vega-expression (>=5.0.1, <=5.1.2)

vega-expression NPM version =5.0.1, =1.0.2, =0.0.332, =0.0.332, =1.1.5, =0.4.1-canary.195, =0.1.0, =3.0.0-alpha.2, =0.0.2, =0.0.1, =0.0.5, =0.0.1, =0.0.8 and more Source cves: CVE-2025-59840 Source advisory: GHSA-7F2V-3QQ3-VVJF...

@omni-co/vega-lite (>=6.2.0-fork.2, <=6.2.0-fork.2-beta.2), arakawa (0.1.0-alpha.1) +3 more potentially affected by CVE-2025-59840 via vega-expression (6.0.0)

vega-expression NPM version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on vega-expression and may be impacted: - @omni-co/vega-lite =6.2.0-fork.2, =6.0.0, =6.0.0, =6.0.0, =6.3.1 Source cves: CVE-2025-59840 Source advisory: GHSA-7F2V-3QQ3-VVJF...

@0xgg/echomd (>=1.0.2, <=1.0.4), @ajuhos/malloy-tests (>=0.0.332, <=0.0.334) +179 more potentially affected by CVE-2025-59840 via vega-expression (>=5.0.1, <=5.1.2)

vega-expression NPM version =5.0.1, =1.0.2, =0.0.332, =0.0.332, =1.1.5, =0.4.1-canary.195, =0.1.0, =3.0.0-alpha.2, =0.0.2, =0.0.1, =0.0.5, =0.0.1, =0.0.8 and more Source cves: CVE-2025-59840 Source advisory: OSV:GHSA-7F2V-3QQ3-VVJF...

@omni-co/vega-lite (>=6.2.0-fork.2, <=6.2.0-fork.2-beta.2), arakawa (0.1.0-alpha.1) +3 more potentially affected by CVE-2025-59840 via vega-expression (6.0.0)

vega-expression NPM version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on vega-expression and may be impacted: - @omni-co/vega-lite =6.2.0-fork.2, =6.0.0, =6.0.0, =6.0.0, =6.3.1 Source cves: CVE-2025-59840 Source advisory: OSV:GHSA-7F2V-3QQ3-VV...

org.webjars.npm:vega-selections (>=5.1.0, <=5.6.0), org.webjars.npm:vega-typings (>=0.22.0, <=0.22.3) potentially affected by CVE-2025-59840 via org.webjars.npm:vega-expression (>=2.7.0, <=5.2.0)

org.webjars.npm:vega-expression MAVEN version =2.7.0, =5.1.0, =0.22.0, =0.22.3 Source cves: CVE-2025-59840 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-13961290...

Cross-site Scripting (XSS)

Overview vega-expression is a Vega expression parser and code generator. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the toString function in environments where the VEGADEBUG global variable is present. An attacker can execute arbitrary JavaScript code by...

Cross-site Scripting (XSS)

Overview org.webjars.npm:vega-expression is a WebJar for vega-expression. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the toString function in environments where the VEGADEBUG global variable is present. An attacker can execute arbitrary JavaScript code by...

@omni-co/vega-lite (>=6.2.0-fork.2, <=6.2.0-fork.2-beta.2), arakawa (0.1.0-alpha.1) +3 more potentially affected by CVE-2025-59840 via vega-expression (6.0.0)

vega-expression NPM version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on vega-expression and may be impacted: - @omni-co/vega-lite =6.2.0-fork.2, =6.0.0, =6.0.0, =6.0.0, =6.3.1 Source cves: CVE-2025-59840 Source advisory:...

@0xgg/echomd (>=1.0.2, <=1.0.4), @ajuhos/malloy-tests (>=0.0.332, <=0.0.334) +179 more potentially affected by CVE-2025-59840 via vega-expression (>=5.0.1, <=5.1.2)

vega-expression NPM version =5.0.1, =1.0.2, =0.0.332, =0.0.332, =1.1.5, =0.4.1-canary.195, =0.1.0, =3.0.0-alpha.2, =0.0.2, =0.0.1, =0.0.5, =0.0.1, =0.0.8 and more Source cves: CVE-2025-59840 Source advisory: SNYK:JS-VEGAEXPRESSION-13961124...

@0xgg/echomd (>=1.0.0, <=1.0.4), @ajuhos/malloy-tests (>=0.0.332, <=0.0.334) +368 more potentially affected by CVE-2025-59840 via vega-expression (>=1.2.1, <=5.1.2)

vega-expression NPM version =1.2.1, =1.0.0, =0.0.332, =0.0.332, =1.1.5, =0.0.1, =0.20.0, =0.20.0, =2.4.22, =0.4.1-canary.195, =0.0.0, =0.1.0, =0.3.0, =0.8.8 and more Source cves: CVE-2025-59840 Source advisory: MEND:CVE-2025-59840...

@omni-co/vega-lite (>=6.2.0-fork.2, <=6.2.0-fork.2-beta.2), arakawa (0.1.0-alpha.1) +3 more potentially affected by CVE-2025-59840 via vega-expression (6.0.0)

vega-expression NPM version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on vega-expression and may be impacted: - @omni-co/vega-lite =6.2.0-fork.2, =6.0.0, =6.0.0, =6.0.0, =6.3.1 Source cves: CVE-2025-59840 Source advisory: MEND:CVE-2025-59840...

EUVD-2025-175318

Inefficient regular expression complexity in certain Zoom Workplace Clients before version 6.5.10 may allow an unauthenticated user to conduct an escalation of privilege via network access...

CVE-2025-62484 Zoom Workplace Clients - Inefficient Regular Expression Complexity

Inefficient regular expression complexity in certain Zoom Workplace Clients before version 6.5.10 may allow an unauthenticated user to conduct an escalation of privilege via network access...

Siemens SIMATIC S7-1500 Uncontrolled Resource Consumption (CVE-2020-8492)

Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service ReDoS attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking. This plugin...