WordPress AForms Eats plugin <= 1.3.1 - Unauthenticated Full Path Disclosure vulnerability

Unauthenticated Full Path Disclosure vulnerability discovered by stealthcopter in WordPress Plugin AForms Eats versions = 1.3.1...

Malicious code in tokocrypto (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 140244d36babc85293499ff8089792224b84b05d04c28d8a761e0ffcd67a36d6 Any computer that has this package install...

Malicious code in probit-internal (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7fda95aa29510bdadd84f77f4192894a8b7ba7729b1fa65823a21672fc9e7674 Any computer that has this package install...

Malicious code in probit-test (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8db186f44c4cce05bf17f2684794f1def34c2db3c28e7b4eb69347459ddb4c76 Any computer that has this package install...

Malicious code in toobit-internal (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4dc2372cd3e422972f9e5ad734631f8915a68a2543a638d01de026ebb0d04436 Any computer that has this package install...

Malicious code in toobit-dev (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d0f3cbca32c205dc8a61718610eba04f690441add92e4fb0e98f1e3f18f21f9 Any computer that has this package install...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: Fixed an out-of-bounds write in triegetnextkey The triegetnextkey function allocates a node stack with a size of trie-maxprefixlen. However, it writes trie-maxprefixlen + 1 nodes to the stack when the stack is full, after...

The vulnerabilities of Kaspersky Anti-Virus SDK for Windows, Kaspersky Security for Virtualization Light Agent, Kaspersky Endpoint Security for Windows, Kaspersky Small Office Security, Kaspersky for Windows (Standard, Plus, Premium), Kaspersky Free, Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Security Cloud, Kaspersky Safe Kids, and Kaspersky Anti-Ransomware Tool are related to a full-width overflow vulnerability, which allows an attacker to write arbitrary data and cause service interruptions.

The vulnerabilities of Kaspersky Anti-Virus SDK for Windows, Kaspersky Security for Virtualization Light Agent, Kaspersky Endpoint Security for Windows, Kaspersky Small Office Security, Kaspersky for Windows Standard, Plus, Premium, Kaspersky Free, Kaspersky Anti-Virus, Kaspersky Internet Securit...

MAL-2025-1267 Malicious code in internallib_v789 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 58ef96477214541474a78705d81d93f2cee8bfdff72d03bc45f30c6431bacfb7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 52471254zqdl55 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0be1df1b5a8a9651a993256d2852094f85ffe9b4e06ae25b53b3894c5a8db5d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-50656

itsourcecode Placement Management System 1.0 is vulnerable to Cross Site Scripting XSS via the Full Name field in registration.php...

Malicious code in my_confused_gcp_function_poc_package_v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8bec1dc81612b6fc6f899e57800501eadadc25d0715b9dbe6a3a22023a484be6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cosmwasmjs-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 034ab0b125042454171dd648c2dd4defeec7fdb36aa9db667c7cd99922881a4c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in zkwasm-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc6469b76f120091996789c8a222676a36dc660a1a3411c27b232b1938a6b40d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dojo_2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a9977fa53d221008b563ff81ff89bc1ebaba9b5b258a2845a3a2aa1dfbe0f302 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in etsy.github.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d1fb9f5d727a671b0737c22729a92ad2c27b39f8dff89f17f5188dc58134b805 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the Web Services component of the Oracle Hyperion Data Relationship Management data management application allows a perpetrator to gain full control over the application.

The vulnerability of the Web Services component of the Oracle Hyperion Data Relationship Management data management application relates to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow an attacker, operating remotely, to gain full control over the...

SUSE CVE-2025-24884

kube-audit-rest is a simple logger of mutation/creation requests to the k8s api. If the "full-elastic-stack" example vector configuration was used for a real cluster, the previous values of kubernetes secrets would have been disclosed in the audit messages. This vulnerability is fixed in 1.0.16...

CVE-2025-23980

Cross-Site Request Forgery CSRF vulnerability in James Andrews Full Circle full-circle allows Stored XSS.This issue affects Full Circle: from n/a through = 0.5.7.8...

CVE-2022-45138

The configuration backend of the web-based management can be used by unauthenticated users, although only authenticated users should be able to use the API. The vulnerability allows an unauthenticated attacker to read and set several device parameters that can lead to full compromise of the devic...