Malicious code in apollo-ms (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d475a426c61513aa519a888a0b2e6968223fdcf3b3ea86c39f8bd0777207c40 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ROS-20250822-18

A vulnerability in the 2D component of the Oracle Java SE software platform and Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines is related to insufficient input validation. and Oracle GraalVM Enterprise Edition virtual machines is related to insufficient input...

ROS-20250822-17

A vulnerability in the 2D component of the Oracle Java SE software platform and Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines is related to insufficient input validation. and Oracle GraalVM Enterprise Edition virtual machines is related to insufficient input...

Malicious code in fb_helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fd02d94679b40d95c81b651a29666a45452deabc83d8e33032104032eef13261 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-55106

CVE-2025-55106 concerns Esri Portal for ArcGIS Enterprise Sites, affected versions 10.9.1–11.4. A stored cross-site scripting vulnerability exists where an authenticated user can inject a malicious file containing an XSS script; when the file is loaded, it may execute arbitrary JavaScript in the ...

[SECURITY] Fedora 41 Update: python3.6-3.6.15-49.fc41

Python 3.6 package for developers. This package exists to allow developers to test their code against an older version of Python. This is not a full Python stack and if you wish to run your applications with Python 3.6, see other distributions that support it, such as CentOS or RHEL with Software...

Linux Distros Unpatched Vulnerability : CVE-2018-17476

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect dialog placement in Cast UI in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obscure the full screen warning via a crafted HTML pag...

PT-2025-34281 · Esri · Esri Portal For Arcgis Enterprise Sites

Name of the Vulnerable Software and Affected Versions: Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 through 11.4 Description: A stored Cross-site Scripting issue exists that may allow a remote, authenticated attacker to inject a malicious file containing an XSS script. When loaded, thi...

Linux Distros Unpatched Vulnerability : CVE-2025-54955

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenNebula Community Edition CE before 7.0.0 and Enterprise Edition EE before 6.10.3 have a critical FireEdge race condition that can lead to full account...

CVE-2025-48168 WordPress Apollo - Sticky Full Width HTML5 Audio Player <= 3.4 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LambertGroup Apollo - Sticky Full Width HTML5 Audio Player lbg-audio5-html5-shoutcast-sticky allows Reflected XSS.This issue affects Apollo - Sticky Full Width HTML5 Audio Player: from n/a through ...

CVE-2025-48168 WordPress Apollo - Sticky Full Width HTML5 Audio Player <= 3.4 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LambertGroup Apollo - Sticky Full Width HTML5 Audio Player lbg-audio5-html5-shoutcast-sticky allows Reflected XSS.This issue affects Apollo - Sticky Full Width HTML5 Audio Player: from n/a through ...

CVE-2025-48168

CVE-2025-48168 applies to the WordPress plugin Apollo - Sticky Full Width HTML5 Audio Player. It describes a Reflected Cross-Site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. Affected software/version: Apollo - Sticky Full Width HTML5 Audio ...

Linux Distros Unpatched Vulnerability : CVE-2017-10276

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: FTS. Supported versions that are affected are 5.6.37 and earlier and 5.7.19 an...

📄 Ilevia EVE X1 Server 4.7.18.0.eden Credentials Leak

A critical vulnerability was identified in the EVE smart home and BMS/BAS controller system due to improper handling of sensitive information in server-side logging. Specifically, .log files accessible via the web server expose cleartext credentials, including username and password submitted duri...

Linux Distros Unpatched Vulnerability : CVE-2021-35648

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: FTS. Supported versions that are affected are 8.0.26 and prior. Easily exploitable...

CVE-2025-38596 drm/panthor: Fix UAF in panthor_gem_create_with_handle() debugfs code

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix UAF in panthorgemcreatewithhandle debugfs code The object is potentially already gone after the drmgemobjectput. In general the object should be fully constructed before calling drmgemhandlecreate, except the...

Malicious code in monitor-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51b3ec369d2a6afae57510092891fcd5712904ac9b195a9bd20099aa37d9c079 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tileuploader (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49889bb016c747fa54e8209157636844c077cd30f04900834d578905f47b61c1 Any computer that has this package installed or running should be considered...

CCFC: Core and Core-Full-Core Dual-Track Defense for LLM Jailbreak Protection

Jailbreak attacks pose a serious challenge to the safe deployment of large language models LLMs. We introduce CCFC Core & Core-Full-Core, a dual-track, prompt-level defense framework designed to mitigate LLMs' vulnerabilities from prompt injection and structure-aware jailbreak attacks. CCFC...

The vulnerability of the FortiOS operating systems and the FortiProxy proxy server regarding authentication bypass through alternative paths or channels allows attackers to gain full control over the device.

The vulnerability of the FortiOS operating system and the FortiProxy proxy server for protection against Internet attacks involves bypassing the authentication process by using an alternative path or channel. Exploiting this vulnerability allows a malicious actor to gain full control over the...