Malicious code in flagd-playground (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 48e70fd6860510489563cf6789b2fee0dfb75544c1e1dfaef731b0b5df5b34dd Any computer that has this package installed or running should be considered...

Malicious code in next-pwa-template (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 598361c7d39c208feedabd0f7d7e0b666d50ad75fa8f2c7db2a64654e3c6a194 Any computer that has this package installed or running should be considered...

Malicious code in zoro-gep-sdk (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 31a52e159d0a3693023b3ef06e39e833dd2b2edbd49add25009006ba7800df90 Any computer that has this package installed or running should be considered...

CVE-2025-5733

The Modern Events Calendar Lite plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 7.21.9. This is due improper or insufficient validation of the id property when exporting calendars. This makes it possible for unauthenticated attackers to retrieve th...

A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deployment

The remarkable success of Large Language Models LLMs has illuminated a promising pathway toward achieving Artificial General Intelligence for both academic and industrial communities, owing to their unprecedented performance across various applications. As LLMs continue to gain prominence in both...

Malicious code in db-prod-interno (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6e74e2b29ed3bfab5c8c71abca03cf2cdd9b065043c14def8d9db5f65d41c60b Any computer that has this package installed or running should be considered...

Malicious code in nginx-internal (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5a0f4d116d3fd75c3c8061c91010e1f912625a9860c89e5af3d3c912296d06de Any computer that has this package installed or running should be considered...

MAL-2025-4752 Malicious code in mssql-internal (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2304e726ecb296faa8d3bc0c0eca49fecae3b3aa9436713580d7a61a9d5b65c7 Any computer that has this package installed or running should be considered...

Malicious code in internal-auth (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6993797579f8f069d60fca14d78ba83e317c578b85e1d0d6c89b395247d0bf1 Any computer that has this package installed or running should be considered...

Malicious code in dev-api-client (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 258921e8b616b5a24a74d27aabeedac0438ae3474367a670f6b8d4b3af7a6f26 Any computer that has this package installed or running should be considered...

CVE-2025-41646 RevPi Webstatus application is vulnerable to an authentication bypass

An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion. This leads to full compromise of the device...

MAL-2025-4918 Malicious code in ac-object (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c8e3af8316e9f831ecb0049a57731e32431e9c7ca54d47aa83341f5774ccd83 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-5733

The Modern Events Calendar Lite plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 7.21.9. This is due improper or insufficient validation of the id property when exporting calendars. This makes it possible for unauthenticated attackers to retrieve th...

CVE-2025-5733 Modern Events Calendar <= 7.21.9 - Information Exposure

The Modern Events Calendar Lite plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 7.21.9. This is due improper or insufficient validation of the id property when exporting calendars. This makes it possible for unauthenticated attackers to retrieve th...

CVE-2025-5733

CVE-2025-5733 affects the Modern Events Calendar Lite plugin for WordPress. The issue is a Full Path Disclosure caused by improper validation of the id parameter during calendar export, enabling unauthenticated attackers to retrieve the web application’s full filesystem path. The disclosure is an...

CVE-2025-5733 Modern Events Calendar <= 7.21.9 - Information Exposure

The Modern Events Calendar Lite plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 7.21.9. This is due improper or insufficient validation of the id property when exporting calendars. This makes it possible for unauthenticated attackers to retrieve th...

Malicious code in sa-sdk-v5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e0560589e860334ad0e8856779bd6f9872639d31e68f117ef013cb4dccb05d5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

📄 ABB Cylon Aspect 3.08.04 DeploySource Unauthenticated Remote Code Execution

ABB Cylon Aspect BMS/BAS version 3.08.04 is vulnerable to a critical flaw in the AuthenticatedHttpServlet within its application server, enabling remote attackers to bypass authentication by setting the Host: 127.0.0.1 header. This deceives the server into processing requests as if they originate...

PT-2025-23991 · WordPress · Modern Events Calendar Lite

Name of the Vulnerable Software and Affected Versions: Modern Events Calendar Lite plugin for WordPress versions up to, and including, 7.21.9 Description: The issue is related to Full Path Disclosure due to improper or insufficient validation of the id property when exporting calendars. This allo...

CVE-2025-5602

A vulnerability, which was classified as critical, was found in Campcodes Hospital Management System 1.0. Affected is an unknown function of the file /admin/registration.php. The manipulation of the argument fullname leads to sql injection. It is possible to launch the attack remotely. The exploi...