761 matches found
CVE-2025-8084 AI Engine <= 3.1.8 - Authenticated (Editor+) Server-Side Request Forgery
The AI Engine plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.8 via the resthelperscreateimages function. This makes it possible for authenticated attackers, with Editor-level access and above, to make web requests to arbitrary locations...
WordPress plugin AI Engine 代码问题漏洞
WordPress AI Engine plugin is a WordPress plugin that is mainly used to integrate OpenAI's ChatGPT, MicrosoftAzure and other AI services into a WordPress website, providing chatbots, content generation, image generation and other features. The WordPress AI Engine plugin suffers from a server-side...
CVE-2025-40119 ext4: fix potential null deref in ext4_mb_init()
In the Linux kernel, the following vulnerability has been resolved: ext4: fix potential null deref in ext4mbinit In ext4mbinit, ext4mbavgfragmentsizedestroy may be called when sbi-smbavgfragmentsize remains uninitialized e.g., if groupinfo slab cache allocation fails. Since...
Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990788)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990788 advisory. In the Linux kernel, the following vulnerability has been resolved: net: tunnels: annotate lockless accesses to dev-neededheadroom IP tunnels can apparently update...
Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989659)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989659 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf: Fix requestsock leak in sk lookup helpers A customer reported a requestsocket leak in a Cali...
Astra Linux – Vulnerability in Linux 6.12
In the Linux kernel, the following vulnerability has been resolved: bnxten: Memory corruption occurs when FW resources change during ifdown. The bnxtsetdfltrings function assumes that it is always called before any TC Traffic Channel is created. Therefore, it does not consider bp-numtc and assume...
CVE-2020-36867
Nagios XI versions prior to 5.7.3 contain a command injection vulnerability in the report PDF download/export functionality. User-supplied values used in the PDF generation pipeline or the wrapper that invokes offline/pdf helper utilities were insufficiently validated or improperly escaped,...
Malicious Package
Overview external-helpers is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
EUVD-2025-36869
Malicious code in external-helpers npm...
Malicious code in external-helpers (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e93035f9471f41f1d28b532573b50bd3f0b5e086d74bc0fbd27e364169d71549 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-49001 Malicious code in external-helpers (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e93035f9471f41f1d28b532573b50bd3f0b5e086d74bc0fbd27e364169d71549 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Server-side Request Forgery (SSRF)
Overview @astrojs/internal-helpers is an Internal helpers used by core Astro packages. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the /image endpoint. An attacker can access internal or unauthorized resources by submitting crafted URLs to the generate...
@1771technologies/oneplay (>=0.0.1 <=0.0.6), @a1st/aix (>=0.0.3 <=0.5.1) +556 more potentially affected by CVE-2025-58179 +1 more via @astrojs/internal-helpers (>=0.0.0-markdoc-config-changes-20230626153541 <=0.7.2)
@astrojs/internal-helpers NPM version =0.0.0-markdoc-config-changes-20230626153541, =0.0.1, =0.0.3, =0.2.0, =1.1.0, =1.0.0, =1.3.0, =0.9.0, =0.5.2, =1.0.0, =1.0.0, =1.0.0, =0.0.17, =0.0.2, =0.0.10 - @astro-component/button =0.0.1 and more Source cves: CVE-2025-58179, CVE-2025-59837 Source advisor...
EUVD-2025-36120
Malicious code in web-vitals-helpers npm...
Malicious code in web-vitals-helpers (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a1207a63be39e0d3a2b8f5721ba241bde1b85c1246c5de3ec904e8eacab4e90 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious Package
Overview web-vitals-helpers is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
MAL-2025-48785 Malicious code in web-vitals-helpers (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a1207a63be39e0d3a2b8f5721ba241bde1b85c1246c5de3ec904e8eacab4e90 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
UBUNTU-CVE-2023-53704
In the Linux kernel, the following vulnerability has been resolved: clk: imx: clk-imx8mp: improve error handling in imx8mpclocksprobe Replace ofiomap and kzalloc with devmofiomap and devmkzalloc which can automatically release the related memory when the device or driver is removed or unloaded to...
