10284 matches found
CVE-2025-57392
BenimPOS Masaustu 3.0.x is affected by insecure file permissions. The application installation directory grants Everyone and BUILTIN\Users groups FILEALLACCESS, allowing local users to replace or modify .exe and .dll files. This may lead to privilege escalation or arbitrary code execution upon...
CVE-2025-10201
Inappropriate implementation in Mojo in Google Chrome on Android, Linux, ChromeOS prior to 140.0.7339.127 allowed a remote attacker to bypass site isolation via a crafted HTML page. Chromium security severity: High...
CVE-2025-58763
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. A command injection vulnerability in Tautulli v2.15.3 and prior allows attackers with administrative privileges to obtain remote code execution on the application server. This vulnerability requires the application to...
Vulnerabilities fixed in Microsoft SQL Server
Microsoft has fixed vulnerabilities in SQL Server. A malicious party could exploit the vulnerabilities to cause a denial-of-service DoS, grant themselves elevated privileges and/or gain access to sensitive data. Microsoft has made updates available that fix the described vulnerabilities. We...
CVE-2025-58374 Roo Code: Auto-approve allows npm install execution of malicious postinstall scripts
Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a default list of allowed commands that do not need manual approval if auto-approve is enabled, and npm install is included in that list. Because npm install executes lifecycle...
CVE-2025-58374
Summary (CVE-2025-58374): Roo Code versions 3.25.23 and earlier allow an auto-approved npm install that can execute a repository’s postinstall script, enabling arbitrary code execution. Root cause: npm install is in the default auto-approve list, so malicious postinstall scripts run without user ...
CVE-2025-58374 Roo Code: Auto-approve allows npm install execution of malicious postinstall scripts
Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a default list of allowed commands that do not need manual approval if auto-approve is enabled, and npm install is included in that list. Because npm install executes lifecycle...
PT-2025-36345
Name of the Vulnerable Software and Affected Versions: Roo Code versions 3.25.23 and below Description: Roo Code is an AI-powered autonomous coding agent. Versions 3.25.23 and below include npm install in a default list of auto-approved commands. Because npm install executes lifecycle scripts, a...
Malicious code in izar-neptune-spectron-webdriver-install (npm)
The package izar-neptune-spectron-webdriver-install was found to contain malicious code...
Malicious code in module-xenos-install-oauth (npm)
The package module-xenos-install-oauth was found to contain malicious code...
Malicious code in janus-install-bunyan-sync (npm)
The package janus-install-bunyan-sync was found to contain malicious code...
Malicious code in interferometry-install-phenomic-mysql (npm)
The package interferometry-install-phenomic-mysql was found to contain malicious code...
MAL-2025-44702 Malicious code in install-eleventy-cluster-element-ui (npm)
The package install-eleventy-cluster-element-ui was found to contain malicious code...
MAL-2025-46238 Malicious code in taphonomy-terser-version-install (npm)
The package taphonomy-terser-version-install was found to contain malicious code...
MAL-2025-44754 Malicious code in janus-install-bunyan-sync (npm)
The package janus-install-bunyan-sync was found to contain malicious code...
MAL-2025-45212 Malicious code in module-xenos-install-oauth (npm)
The package module-xenos-install-oauth was found to contain malicious code...
CVE-2025-22425
In onCreate of InstallStart.java, there is a possible permissions bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...
CVE-2025-38722
In the Linux kernel, the following vulnerability has been resolved: habanalabs: fix UAF in exportdmabuf As soon as we'd inserted a file reference into descriptor table, another thread could close it. That's fine for the case when all we are doing is returning that descriptor to userland it's a...
CVE-2025-38722
CVE-2025-38722: Linux kernel HABANA Labs export_dmabuf() UAF due to race between descriptor table fd_install() and object destruction in ->release(). Root cause: a descriptor in dma_buf_fd() may be installed and used while the referenced file/object could be freed, leading to use-after-free. M...