MAL-2025-44601 Malicious code in hercules-grus-css-loader-package (npm)

The package hercules-grus-css-loader-package was found to contain malicious code...

MAL-2025-46598 Malicious code in webdriver-manager-plutology-postcss-loader-meissa (npm)

The package webdriver-manager-plutology-postcss-loader-meissa was found to contain malicious code...

MAL-2025-45730 Malicious code in query-less-loader-passport-rest (npm)

The package query-less-loader-passport-rest was found to contain malicious code...

MAL-2025-45090 Malicious code in magellan-taphonomy-jest-postcss-loader (npm)

The package magellan-taphonomy-jest-postcss-loader was found to contain malicious code...

MAL-2025-44989 Malicious code in less-loader-quasar-spectroscopy-astrobiology (npm)

The package less-loader-quasar-spectroscopy-astrobiology was found to contain malicious code...

MAL-2025-46192 Malicious code in tailwindcss-tailwindcss-dotenv-safe-less-loader (npm)

The package tailwindcss-tailwindcss-dotenv-safe-less-loader was found to contain malicious code...

MAL-2025-44988 Malicious code in less-loader-ablation-frontend-transport (npm)

The package less-loader-ablation-frontend-transport was found to contain malicious code...

MAL-2025-46478 Malicious code in ursa-nestjs-less-loader-sails (npm)

The package ursa-nestjs-less-loader-sails was found to contain malicious code...

MAL-2025-44699 Malicious code in ini-envconfig-less-loader-hadron (npm)

The package ini-envconfig-less-loader-hadron was found to contain malicious code...

Malicious code in magellan-taphonomy-jest-postcss-loader (npm)

The package magellan-taphonomy-jest-postcss-loader was found to contain malicious code...

CVE-2025-56803

Figma Desktop for Windows version 125.6.5 contains a command injection vulnerability in the local plugin loader. An attacker can execute arbitrary OS commands by setting a crafted build field in the plugin's manifest.json. This field is passed to childprocess.exec without validation, leading to...

GdkPixbuf LZW Decoder Unauthorized Access

The vulnerability of the LZW decoder in the GdkPixbuf image loading library is related to the disclosure of information. Exploiting this vulnerability could allow an intruder to gain unauthorized access to protected information...

Fuji Electric FRENIC-Loader 4 Deserialization Vulnerability

Fuji Electric FRENIC-Loader 4 is a computer software designed for Fuji Electric inverters such as the FRENIC series, mainly for parameter setting, monitoring and debugging. A deserialization vulnerability exists in Fuji Electric FRENIC-Loader 4, which can be exploited by an attacker to execute...

CVE-2025-32321

In isSafeIntent of AccountTypePreferenceLoader.java, there is a possible way to bypass an intent type check due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Grub2: jfs: integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data

...

Grub2: reiserfs: integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data

...

Grub2: udf: heap based buffer overflow in grub_udf_read_block() may lead to arbitrary code execution

...

CVE-2025-6984

CVE-2025-6984 (LangChain EverNoteLoader XXE) : The langchain-ai/langchain package’s EverNoteLoader is vulnerable to XML External Entity (XXE) attacks due to insecure XML parsing. The affected version is 0.3.63, where etree.iterparse() is used without disabling external entity processing, enabling...

GNU GRUB (aka GRUB2) through 2.12 has a heap-based buffer overflow in fs/hfs.c via crafted sblock data in an HFS filesystem.

...

sqfs_search_dir in Das U-Boot before 2025.01-rc1 exhibits an off-by-one error and resultant heap memory corruption for squashfs directory listing because the path separator is not considered in a size calculation.

...