CVE-2025-7115

The CVE-2025-7115 entry concerns rowboatlabs rowboat, specifically the Session Handler component. The vulnerable element is the function PUT in file apps/rowboat/app/api/uploads/[fileId]/route.ts, where manipulation of the params argument leads to missing authentication, enabling remote exploitat...

FreeBSD : redis,valkey -- {redis,valkey}-check-aof may lead to stack overflow and potential RCE (4ea9cbc3-5b28-11f0-b507-000c295725e4)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 4ea9cbc3-5b28-11f0-b507-000c295725e4 advisory. Simcha Kosman & CyberArk Labs reports: A user can run the redis,valkeyu-check-aof cli and pass a long...

Grafana Labs 10.4.x < 10.4.19, 11.2.x < 11.2.10, 11.3.x < 11.3.7, 11.4 < 11.4.5, 11.5 < 11.5.5, 11.6 < 11.6.2, 12.0.x < 12.0.1 Improper Access Control (CVE-2025-3580)

The version of Grafana Labs installed on the remote host is affected by an improper access control vulnerability as referenced in the CVE-2025-3580 advisory. - An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server...

Grafana Labs 11.1.0 < 11.2.8+security-01, 11.3.5+security-01, 11.4.3+security-01, 11.5.3+security-01, 11.6.0+security-01 XSS (CVE-2025-2703)

The version of Grafana Labs installed on the remote host is affected by cross-site scripting vulnerability as referenced in the CVE-2025-2703 advisory. - The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in order t...

Denial Of Service (DoS)

github.com/babylonlabs-io/babylon is vulnerable to Denial Of Service DoS. The vulnerability is due to the acceptance of transaction fees in denominations other than the native Babylon genesis denom ubbn, which allows an attacker to halt the blockchain by submitting such transactions...

Grafana Labs < 11.6.2 Improper Input Validation (CVE-2025-1088)

The version of Grafana Labs installed on the remote host is affected by an improper input validation vulnerability as referenced in the CVE-2025-1088 advisory. In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to improper input...

Malicious code in phantom-labs-sandbox (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9fd1e98be0b346737740a6114c37dc7dd21cd328f21d026e07d9eb0348e43464 Any computer that has this package installed or running should be considered...

MAL-2025-5095 Malicious code in aliyun-ai-labs-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in aliyun-ai-labs-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=-...

PT-2025-25295

EchoLeak: First-Ever Zero-Click Vulnerability, CVE-2025-3271, Discovered by Aim Labs in Microsoft 365 Copilot AI, Allowed Attackers Steal Sensitive Data Silently, Now Fixed EchoLeak Hackers Microsoft Copilot CopilotAgent MIcrosoft365 @Microsoft @Copilot...

Grafana Labs < 11.6.1+security-01 Authorization Bypass (CVE-2025-3260)

The version of Grafana Labs installed on the remote host is affected by a vulnerability as referenced in the CVE-2025-3260 advisory. Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with minimal permissions could...

Malicious code in beacon-labs-translations (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

MAL-2025-4731 Malicious code in beacon-labs-translations (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

Malware Hidden in AI Models on PyPI Targets Alibaba AI Labs Users

ReversingLabs discovers new malware hidden inside AI/ML models on PyPI, targeting Alibaba AI Labs users. Learn how attackers…...

Threats don’t wait, neither should you: Mastering Emergent Threat Response Validation

Cybersecurity is a team sport In cybersecurity, no one fights alone. Defending against modern threats requires seamless collaboration, real-time intelligence, and precision execution—just like a well-coordinated sports team. That’s why Rapid7 Labs and our Vector Command team work together to stay...

CVE-2025-24701

Server-Side Request Forgery SSRF vulnerability in Bob Chained Quiz chained-quiz allows Server Side Request Forgery.This issue affects Chained Quiz: from n/a through = 1.3.2.9...

CVE-2024-34823

Cross-Site Request Forgery CSRF vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter.This issue affects Arigato Autoresponder and Newsletter: from n/a through 2.7.2.3...

CVE-2024-0240

A memory leak in the Silicon Labs' Bluetooth stack for EFR32 products may cause memory to be exhausted when sending notifications to multiple clients, this results in all Bluetooth operations, such as advertising and scanning, to stop...

CVE-2024-3017

In a Silicon Labs multi-protocol gateway, a corrupt pointer to buffered data on a multi-protocol radio co-processor RCP causes the OpenThread Border RouterOTBR application task running on the host platform to crash, allowing an attacker to cause a temporary denial-of-service...

CVE-2024-3166

A Cross-Site Scripting XSS vulnerability exists in mintplex-labs/anything-llm, affecting both the desktop application version 1.2.0 and the latest version of the web application. The vulnerability arises from the application's feature to fetch and embed content from websites into workspaces, whic...