MAL-2025-19112 Malicious code in ecelue (npm)

The package ecelue was found to contain malicious code...

MAL-2025-27199 Malicious code in nectar-glisten-nom856-project (npm)

The package nectar-glisten-nom856-project was found to contain malicious code...

MAL-2025-21028 Malicious code in fucoin (npm)

The package fucoin was found to contain malicious code...

MAL-2025-19196 Malicious code in ecosystem-iris-eab640-project (npm)

The package ecosystem-iris-eab640-project was found to contain malicious code...

MAL-2025-29205 Malicious code in pi-async-runtime-report-sun (npm)

The package pi-async-runtime-report-sun was found to contain malicious code...

MAL-2025-14329 Malicious code in almanan (npm)

The package almanan was found to contain malicious code...

MAL-2025-21917 Malicious code in gregarius (npm)

The package gregarius was found to contain malicious code...

OPENSUSE-SU-2025:15387-1 libmozjs-128-0-128.13.0-1.1 on GA media

These are all security issues fixed in the libmozjs-128-0-128.13.0-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2025-30061

Name of the Vulnerable Software and Affected Versions form-data versions 2.5.4 form-data versions 3.0.0 through 3.0.3 form-data versions 4.0.0 through 4.0.3 Description A vulnerability exists in the form-data JavaScript library due to the use of insufficiently random values when generating bounda...

CVE-2025-53569

Cross-Site Request Forgery CSRF vulnerability in Trust Payments Trust Payments Gateway for WooCommerce JavaScript Library trust-payments-gateway-3ds2 allows Cross Site Request Forgery.This issue affects Trust Payments Gateway for WooCommerce JavaScript Library: from n/a through = 1.3.6...

CVE-2025-2537

Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled ThickBox JavaScript library version 3.1 in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-53569

Cross-Site Request Forgery CSRF vulnerability in Trust Payments Trust Payments Gateway for WooCommerce JavaScript Library trust-payments-gateway-3ds2 allows Cross Site Request Forgery.This issue affects Trust Payments Gateway for WooCommerce JavaScript Library: from n/a through = 1.3.6...

CVE-2025-53569

CVE-2025-53569 covers a CSRF vulnerability in the Trust Payments Gateway for WooCommerce (JavaScript Library). The issue affects the plugin’s JavaScript library up to and including version 1.3.6. The connected sources consistently describe CSRF as the flaw, with no explicit exploit details provid...

CVE-2025-53569 WordPress Trust Payments Gateway for WooCommerce (JavaScript Library) plugin <= 1.3.6 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in Trust Payments Trust Payments Gateway for WooCommerce JavaScript Library trust-payments-gateway-3ds2 allows Cross Site Request Forgery.This issue affects Trust Payments Gateway for WooCommerce JavaScript Library: from n/a through = 1.3.6...

CVE-2025-53569 WordPress Trust Payments Gateway for WooCommerce (JavaScript Library) plugin <= 1.3.6 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in Trust Payments Trust Payments Gateway for WooCommerce JavaScript Library trust-payments-gateway-3ds2 allows Cross Site Request Forgery.This issue affects Trust Payments Gateway for WooCommerce JavaScript Library: from n/a through = 1.3.6...

WordPress plugin Trust Payments Gateway for WooCommerce (JavaScript Library) 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

Magnific Popups JavaScript Library < 1.2.0 - Contributor+ Stored XSS

Description Multiple plugins are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library version 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

GHSA-994J-5C83-R424 string-math's string-math.js vulnerability can cause Regex Denial of Service (ReDoS)

string-math v1.2.2 was discovered to contain a Regex Denial of Service ReDoS which is exploited via a crafted input...

CVE-2025-45526

A denial of service DoS vulnerability has been identified in the JavaScript library microlight version 0.0.7. This library, used for syntax highlighting, does not limit the size of textual content it processes in HTML elements with the microlight class. When excessively large content e.g., 100...

Hidden Malware Discovered in jQuery Migrate: A Stealthy Supply Chain Threat

Hidden Malware Discovered in jQuery Migrate: A Stealthy Supply Chain Threat By Trellix · June 18, 2025 This blog was also written by Trishaan Kalra Introduction What happens when a trusted open source library becomes a conduit for stealthy malware delivery? That question became reality when the...