GHSA-QR9H-J6XG-2J72 Qwik's unhandled exception vulnerabilty can cause server crashes from malicious requests

Summary Possibility to craft a request that will crash the Qwik Server in the default configuration. Details When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an invalid qfunc is sent, the server does not handle the thrown error. The error then...

PT-2025-37733

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=430091578 Crash type: Heap-buffer-overflow READ 2 Crash state: js create function JS EvalInternal JS EvalObject...

Malicious code in phone-mockup-react-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0f6a1418f459219963b15e9792b3f8721f33e7d7f3bf802a570652c6f3a5faad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in phone-mockup-react-js

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in my-js-cdn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0ded23b9cb07e2872a7f6c888c1561c2341dbefc0efe38eed634d46229785725 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5710 Malicious code in my-js-cdn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0ded23b9cb07e2872a7f6c888c1561c2341dbefc0efe38eed634d46229785725 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in my-js-cdn

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in mapbox-gl-js

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

OSV-2025-524 Heap-buffer-overflow in JS_CallInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=429330008 Crash type: Heap-buffer-overflow READ 1 Crash state: JSCallInternal asyncfuncresume jsasyncfunctionresume...

PT-2025-37251

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=429330008 Crash type: Heap-buffer-overflow READ 1 Crash state: JS CallInternal async func resume js async function resume...

CVE-2025-7046

The Portfolio for Elementor & Image Gallery | PowerFolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS Attributes of Plugin's widgets in all versions up to, and including, 3.2.0 due to insufficient input sanitization and output escaping. This makes it possibl...

CVE-2025-7046 Portfolio for Elementor & Image Gallery | PowerFolio <= 3.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS

The Portfolio for Elementor & Image Gallery | PowerFolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS Attributes of Plugin's widgets in all versions up to, and including, 3.2.0 due to insufficient input sanitization and output escaping. This makes it possibl...

CVE-2025-7046 Portfolio for Elementor & Image Gallery | PowerFolio <= 3.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS

The Portfolio for Elementor & Image Gallery | PowerFolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS Attributes of Plugin's widgets in all versions up to, and including, 3.2.0 due to insufficient input sanitization and output escaping. This makes it possibl...

CVE-2025-7046

CVE-2025-7046 : The Portfolio for Elementor & Image Gallery | PowerFolio plugin for WordPress is vulnerable to a stored cross-site scripting (XSS) attack via the Custom JS Attributes of plugin widgets in all versions up to and including 3.2.0. Exploitation requires authenticated access at Contrib...

CVE-2025-7046: Improper Neutralization of Input During Web Page Generation

The Portfolio for Elementor & Image Gallery | PowerFolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS Attributes of Plugin's widgets in all versions up to, and including, 3.2.0 due to insufficient input sanitization and output escaping. This makes it possibl...

PT-2025-38754

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=428754593 Crash type: Use-of-uninitialized-value Crash state: JS DefineProperty build backtrace JS CallInternal...

Malicious code in dds-js (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d47ebdc1891b1fd02986098c63e73de75cf01ce8c67fc24f74ec39c86a04e866 The OpenSSF Package Analysis project identified 'dds-js' @ 2.4.0 npm ...

MAL-2025-5495 Malicious code in dtable-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4325bcefb1ef8dd7bf39cc694fc039f034e9a3811c8af4e36099a9d2bb375318 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dtable-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4325bcefb1ef8dd7bf39cc694fc039f034e9a3811c8af4e36099a9d2bb375318 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in dtable-js

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...