Malicious code in isctf16 (npm)

The package opens up arbitrary backdoor port that allows bad actors to connect to. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 236c481ceb4416a920a9cf23c72217913d688a6e2aa10edf1f633acecdaf131b Any computer that has this package installed or running should be...

Malicious code in browser-nextjs (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f4a391b07d3a459e7dd200191edde3d936f11a865bcecc3ac54f1210b905ee6c Any computer that has this package installed or running should be considered...

Malicious code in mpl-token-metadata (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5e20c7d93bbedc5a446405747356b754aec260f1716a86efbef222f15a52385e Any computer that has this package installed or running should be considered...

Malicious code in smartling-openapi-spec (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 21a5bc79af548e1ec5706ef28aa4991242b628e7fb312ee2141f58d6aa46d16b Any computer that has this package installed or running should be considered...

Malicious code in qiot (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3059320d7f7fe85fa1c9a9b6ab7e8ee74f13c6994b93f055fd27db8fbdf7b468 Any computer that has this package installed or running should be considered...

Malicious code in react-native-country-picker-modal-modified (npm)

The package executes harmful command in pre-installation script to send sensitive data to an arbitrary domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 69921c906d4d0ecfa3ba0de532e27f29b18c6be04a563ba99aa0590b1fcc77a8 Any computer that has this package install...

WordPress plugin Full Circle 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site request forge...

CVE-2025-24718: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in activity-log.com WP Sessions Time Monitoring Full Automatic activitytime allows Reflected XSS.This issue affects WP Sessions Time Monitoring Full Automatic: from n/a through = 1.1.1...

CVE-2025-23980: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in James Andrews Full Circle full-circle allows Stored XSS.This issue affects Full Circle: from n/a through = 0.5.7.8...

PT-2025-5243 · Unknown · Full Circle

Name of the Vulnerable Software and Affected Versions: Full Circle versions 0.5.7.8 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. Recommendations: For versions 0.5.7.8 and earlier, update to a version that contains a fix for this...

Malicious code in addon-sdk (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c577c976c628e28178068560e5d64a099c595fddbdc191ec9343ac7ee6149712 Any computer that has this package installed or running should be considered...

Malicious code in test_package_file (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 53b443550dc59ee48bf343b26a7e563407dc65e43fc2fd49c177854a1ecb70eb Any computer that has this package installed or running should be considered...

Malicious code in grammyjs-utils (npm)

This package adds the attacker's public SSH key to the user's authorizedkeys file, creating a backdoor. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45f0349da339aac302d4c3bf992403e9bd539caa80f29576e448ccf3fb4af016 Any computer that has this package installed or...

Malicious code in telegram-util (npm)

This package adds the attacker's public SSH key to the user's authorizedkeys file, creating a backdoor. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 259b69f583bb3ea0fcb76890f5361a9c8e9d784fcca352a51f4dd13e7d73e1c7 Any computer that has this package installed or...

fs/ntfs3: Fix general protection fault in run_is_mapped_full

...

PT-2025-5591 · Unknown +1 · Kube-Audit-Rest +1

Name of the Vulnerable Software and Affected Versions: kube-audit-rest versions prior to 1.0.16 Description: The issue concerns a simple logger of mutation/creation requests to the k8s API, where the previous values of Kubernetes secrets would have been disclosed in the audit messages if the...

kube-audit-rest 安全漏洞

kube-audit-rest is a Kubernetes audit logging by Richard Tweed Personal Developer. A security vulnerability exists in kube-audit-rest versions prior to 1.0.16, which stems from the fact that previous values of kubernetes secrets are leaked in audit messages if the full-elastic-stack example vecto...

CVE-2025-24884: Exposure of Sensitive Information to an Unauthorized Actor

kube-audit-rest is a simple logger of mutation/creation requests to the k8s api. If the "full-elastic-stack" example vector configuration was used for a real cluster, the previous values of kubernetes secrets would have been disclosed in the audit messages. This vulnerability is fixed in 1.0.16...

Security Bulletin: Improper Resource Allocation in IBM Jazz for Service Management due to Apache Commons IO XmlStreamReader Class (CVE-2024-47554)

Summary Improper Resource Allocation in IBM Jazz for Service Management due to Apache Commons IO XmlStreamReader Class CVE-2024-47554 Vulnerability Details CVEID:CVE-2024-47554 DESCRIPTION: Apache Commons IO is vulnerable to a denial of service, caused by an uncontrolled resource consumption flaw...

Malicious code in compound-protocol-alpha (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 03d150fbb080030ea3445a65033db1386bff9efd41db369c041100a4eedbcea6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...