MAL-2025-18711 Malicious code in down-load-available-zip-now-8393-wait-for-me-jdvqg-evxzsz (npm)

The package down-load-available-zip-now-8393-wait-for-me-jdvqg-evxzsz was found to contain malicious code...

MAL-2025-20785 Malicious code in fork-serialize-secure-grid-load (npm)

The package fork-serialize-secure-grid-load was found to contain malicious code...

MAL-2025-18707 Malicious code in down-load-available-zip-now-18341-x-xcib7-hnjfai (npm)

The package down-load-available-zip-now-18341-x-xcib7-hnjfai was found to contain malicious code...

MAL-2025-25472 Malicious code in load-runtime-benchmark-hash-cluster (npm)

The package load-runtime-benchmark-hash-cluster was found to contain malicious code...

MAL-2025-18709 Malicious code in down-load-available-zip-now-246213-articulation-ezaoj-nnjghf (npm)

The package down-load-available-zip-now-246213-articulation-ezaoj-nnjghf was found to contain malicious code...

MAL-2025-27877 Malicious code in nu-refactor-load-boolean-log (npm)

The package nu-refactor-load-boolean-log was found to contain malicious code...

MAL-2025-18713 Malicious code in down-load-available-zip-now-in-evening-air-h64zx-skufkw (npm)

The package down-load-available-zip-now-in-evening-air-h64zx-skufkw was found to contain malicious code...

MAL-2025-30758 Malicious code in protected-emulate-star-fire-load (npm)

The package protected-emulate-star-fire-load was found to contain malicious code...

MAL-2025-15148 Malicious code in avail-able-albu-m-down-load-41111-camoufleur-t3gly-fjscto (npm)

The package avail-able-albu-m-down-load-41111-camoufleur-t3gly-fjscto was found to contain malicious code...

CVE-2025-50515

An issue was discovered in phome Empirebak 2010 in ebak2008/upload/class/config.php allowing attackers to execute arbitrary code when the config file was loaded...

CVE-2025-50515

An issue was discovered in phome Empirebak 2010 in ebak2008/upload/class/config.php allowing attackers to execute arbitrary code when the config file was loaded...

Flowise Custom MCP Remote Code Execution

This module exploits a remote code execution vulnerability in Flowise versions = 2.2.7-patch.1 and use exploit/multi/http/flowise/custommcprce msf undefinedcustommcprce show actions ...actions... msf undefinedcustommcprce set ACTION msf undefinedcustommcprce show options ...show and set options...

NVIDIA Transformers4Rec load_model_trainer_states_from_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NVIDIA Transformers4Rec. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2025-8747

A safe mode bypass vulnerability in the Model.loadmodel method in Keras versions 3.0.0 through 3.10.0 allows an attacker to achieve arbitrary code execution by convincing a user to load a specially crafted .keras model archive...

CVE-2025-8854

Stack-based buffer overflow in LoadOFF in bulletphysics bullet3 before 3.26 on all platforms allows remote attackers to execute arbitrary code via a crafted OFF file with an overlong initial token processed by the VHACD test utility or invoked indirectly through PyBullet's vhacd function...

PT-2025-37230

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A flaw exists in the Linux kernel’s drm/hisilicon/hibmc driver related to handling hibmc loading failures. When hibmc loading fails, the driver attempts to free resources using hibmc...

Keras vulnerable to CVE-2025-1550 bypass via reuse of internal functionality

Summary It is possible to bypass the mitigation introduced in response to CVE-2025-1550, when an untrusted Keras v3 model is loaded, even when “safemode” is enabled, by crafting malicious arguments to built-in Keras modules. The vulnerability is exploitable on the default configuration and does n...

CVE-2025-8568

The GMap Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘h’ parameter in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

OSV-2025-616 Heap-buffer-overflow in Open

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=437593508 Crash type: Heap-buffer-overflow READ 7 Crash state: Open demuxProbe vlcmoduleload...

Load-Altering Attacks against Power Grids: a Case Study Using the GB-36 Bus System Open Dataset

The growing digitalization and the rapid adoption of high-powered Internet-of-Things IoT-enabled devices e.g., EV charging stations have increased the vulnerability of power grids to cyber threats. In particular, the so-called Load Altering Attacks LAAs can trigger rapid frequency fluctuations an...