MAL-2025-191552 Malicious code in tailwind-scrollbar-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a67e29aab551c12aaffda6a2fca81e67eb1a1c4a1f4e2a8f544147c7b0182b2d The package tailwind-scrollbar-plugin was found to contain malicious code. Source: ghsa-malware...

Malicious code in @shr3k/tdspt-helper-ng (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d47ecdb7596afb82ccce510809a10347891034b43f4948239690d2c0bb69b470 The package @shr3k/tdspt-helper-ng was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191541 Malicious code in bignumx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 745b8508e8818e81e53f71cf2467fa31620191825b820f424eb9f86ab1e5f49e The package bignumx was found to contain malicious code. Source: ghsa-malware 98b45b53c91ebee4c77ebf3ba359608318ce17878eb8edb1cbd2a7e65238dbff Any...

CVE-2025-61229

An issue in Shirt Pocket's SuperDuper! 3.10 and earlier allow a local attacker to modify the default task template to execute an arbitrary preflight script with root privileges and Full Disk Access, thus bypassing macOS privacy controls...

EUVD-2025-200025

An issue in Shirt Pocket's SuperDuper! 3.10 and earlier allow a local attacker to modify the default task template to execute an arbitrary preflight script with root privileges and Full Disk Access, thus bypassing macOS privacy controls...

EUVD-2025-200016

Incorrect Authorization vulnerability in Data Illusion Zumbrunn NGSurvey allows any logged-in user to obtain the private information of any other user. Critical information retrieved: APIKEY 1 year user Session RefreshToken 10 minutes user Session Password hashed with bcrypt User IP Email Full Na...

CVE-2025-61229

An issue in Shirt Pocket's SuperDuper! 3.10 and earlier allow a local attacker to modify the default task template to execute an arbitrary preflight script with root privileges and Full Disk Access, thus bypassing macOS privacy controls...

CVE-2025-13829

Incorrect Authorization vulnerability in Data Illusion Zumbrunn NGSurvey allows any logged-in user to obtain the private information of any other user. Critical information retrieved: APIKEY 1 year user Session RefreshToken 10 minutes user Session Password hashed with bcrypt User IP Email Full Na...

CVE-2025-13829

Incorrect Authorization vulnerability in Data Illusion Zumbrunn NGSurvey allows any logged-in user to obtain the private information of any other user. Critical information retrieved: APIKEY 1 year user Session RefreshToken 10 minutes user Session Password hashed with bcrypt User IP Email Full Na...

CVE-2025-13829

Incorrect Authorization vulnerability in Data Illusion Zumbrunn NGSurvey allows any logged-in user to obtain the private information of any other user. Critical information retrieved: APIKEY 1 year user Session RefreshToken 10 minutes user Session Password hashed with bcrypt User IP Email Full Na...

CVE-2025-13829

CVE-2025-13829 affects Data Illusion Zumbrunn NGSurvey and is described as an Incorrect Authorization vulnerability that lets any logged-in user access private data of other users. Publicly reported details across multiple sources (NVD, Red Hat, EUVD, CVE.org, CNNVD, etc.) enumerate sensitive dat...

PT-2025-48487

An issue in Shirt Pocket's SuperDuper! 3.10 and earlier allow a local attacker to modify the default task template to execute an arbitrary preflight script with root privileges and Full Disk Access, thus bypassing macOS privacy controls...

CVE-2025-61229

Connected documents confirm a concrete vulnerability in Shirt Pocket’s SuperDuper!

PT-2025-48486

Name of the Vulnerable Software and Affected Versions Data Illusion Zumbrunn NGSurvey affected versions not specified Description An incorrect authorization issue exists in Data Illusion Zumbrunn NGSurvey, allowing any authenticated user to access the private information of other users. This...

CVE-2025-61229

An issue in Shirt Pocket's SuperDuper! 3.10 and earlier allow a local attacker to modify the default task template to execute an arbitrary preflight script with root privileges and Full Disk Access, thus bypassing macOS privacy controls...

VulnCheck KEV: CVE-2024-8852

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.86 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information such as full...

CVE-2025-66266

The RupsMon.exe service executable in UPSilon 2000 has insecure permissions, allowing the 'Everyone' group Full Control. A local attacker can replace the executable with a malicious binary to execute code with SYSTEM privileges or simply change the config path of the service to a command; startin...

EUVD-2025-199763

An unauthenticated administrative access vulnerability exists in the open-source HashTech project https://github.com/henzljw/hashtech 1.0 thru commit 5919decaff2681dc250e934814fc3a35f6093ee5 2021-07-02. Due to missing authentication checks on /adminindex.php, an attacker can directly access the...

CVE-2025-65276

An unauthenticated administrative access vulnerability exists in the open-source HashTech project https://github.com/henzljw/hashtech 1.0 thru commit 5919decaff2681dc250e934814fc3a35f6093ee5 2021-07-02. Due to missing authentication checks on /adminindex.php, an attacker can directly access the...

Malicious code in chai-jsons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e738779b172365174b2a7765325ea0405726a7ce192ddd47025b964d5e134ec The package chai-jsons was found to contain malicious code. Source: ghsa-malware 84b31461976f0984f6a6828d87f0cda7b1e3323084608a91ca02bedcee04357b Any...