GHSA-MJCP-RJ3C-36FR Rancher sends sensitive information to external services through the `/meta/proxy` endpoint

Impact A vulnerability has been identified within Rancher Manager whereby Impersonate-Extra- headers are being sent to an external entity, for example amazonaws.com, via the /meta/proxy Rancher endpoint. These headers may contain identifiable and/or sensitive information e.g. email addresses. If...

Exploit for Improper Restriction of XML External Entity Reference in Jetbrains Ktor

PoC exploit for CVE-2023-45612, a XXE vulnerability. The target...

MAL-2025-47629 Malicious code in com.unity.external.test-protocol (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in com.unity.external.test-protocol (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious Package

Overview postmark-mcp is a malicious package. This is an MCP Model Context Protocol server intended to let AI assistants send emails via Postmark and it was reportedly modified to secretly exfiltrate email contents by adding a blind-copy BCC to an external domain. Note: If you have installed or...

Malicious code in kite-public (npm)

The package communicates with a domain associated with malicious activity...

PT-2025-39666

Name of the Vulnerable Software and Affected Versions Rancher Manager versions prior to 2.9.12 Rancher Manager versions prior to 2.10.10 Rancher Manager versions prior to 2.11.6 Rancher Manager versions prior to 2.12.2 Description A flaw exists in Rancher Manager that allows sensitive information...

PT-2025-39675

Name of the Vulnerable Software and Affected Versions Jinher OA version 2.0 Description A flaw exists in Jinher OA 2.0 that allows for xml external entity reference. This issue is related to an unknown function within the file /c6/Jhsoft.Web.module/ToolBar/ManageWord.aspx/?text=GetUrl=1. The atta...

Jinher OA 代码问题漏洞

Jinher OA is a collaborative management software from Jinher, China. A code issue vulnerability exists in Jinher OA version 2.0, which originates from the file /c6/Jhsoft.Web.module/ToolBar/ManageWord.aspx/?text=GetUrl&style=1 There is a reference to an external entity in XML, which could lead to...

TRUSTCHECKPOINTS: Time Betrays Malware for Unconditional Software Root of Trust

Modern IoT and embedded platforms must start execution from a known trusted state to thwart malware, ensure secure firmware updates, and protect critical infrastructure. Current approaches to establish a root of trust depend on secret keys and/or specialized secure hardware, which drives up costs...

CVE-2023-8910

creationtimestamp| type| source ---|---|--- 2025-09-25 15:28:03+00:00| seen| https://gist.github.com/Darkcrai86/ff45598f5231f7dc8bb2b82a0bfda311...

Malicious code in @discord-external/activity-iframe-sdk (npm)

The package @discord-external/activity-iframe-sdk was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: google-open-source-security c4df7af2ceae80fdc052edf95094a378287786ae21cfec9a6104a2af2b1d9b98 This package installs a dependency hosted on a cust...

MAL-2025-47574 Malicious code in @discord-external/activity-iframe-sdk (npm)

The package @discord-external/activity-iframe-sdk was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: google-open-source-security c4df7af2ceae80fdc052edf95094a378287786ae21cfec9a6104a2af2b1d9b98 This package installs a dependency hosted on a cust...

CVE-2025-57318

creationtimestamp| type| source ---|---|--- 2025-09-25 05:23:42+00:00| seen| https://gist.github.com/Darkcrai86/dd2d95d37934e5b8a53d18e11401236a...

Malicious code in giffgaff-status (npm)

The package giffgaff-status was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bcde685cc836f4f80fa6ae182e03b2bd9bae41b818468a5bbde4e94cbd4443ff Any computer that has this package installed or running should be considered fully...

commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default

A flaw was found in Apache Commons BeanUtils. This vulnerability allows remote attackers to execute arbitrary code via uncontrolled access to the declaredClass property on Java enum objects, which can expose the class loader when property paths are passed from external sources to methods like...

E-Commerce Website Website /pages/admin_account_delete.php File SQL Injection Vulnerability

E-Commerce Website is an e-commerce website. E-Commerce Website suffers from a SQL injection vulnerability that originates from the lack of validation of the userid parameter in the file /pages/adminaccountdelete.php for externally entered SQL statements. An attacker can exploit this vulnerabilit...

Configure Proper Policies for INPUT of iptables

The INPUT chain is used to filter packets received from external systems. For any service provided for external systems, configure the corresponding INPUT policy and enable the related port so that external clients can access the service through the port. If the policy is not set, all packets tha...

CVE-2025-10816

A security flaw has been discovered in Jinher OA 2.0. This affects an unknown part of the file /c6/Jhsoft.Web.module/ToolBar/GetWordFileName.aspx/?text=GetUrl=add of the component XML Handler. Performing manipulation results in xml external entity reference. The attack may be initiated remotely...

GO-2025-3966 Dragonfly's manager makes requests to external endpoints with disabled TLS authentication in d7y.io/dragonfly

Dragonfly's manager makes requests to external endpoints with disabled TLS authentication in d7y.io/dragonfly...