EUVD-2025-201091

DeepChat is a smart assistant uses artificial intelligence. In 0.5.0 and earlier, there is a Stored Cross-Site Scripting XSS vulnerability in the Mermaid diagram renderer allows an attacker to execute arbitrary JavaScript within the application context. By leveraging the exposed Electron IPC...

Improper Certificate Validation

github.com/in-toto/go-witness is vulnerable to Improper Certificate Validation. The vulnerability is due to the AWS attestor accepting EC2 instance identity documents without properly validating signatures and relying on outdated public certificates, which allows an attacker to supply or intercep...

Malicious Package

Overview old-hd-keyring is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

EUVD-2025-200009

Malicious code in old-hd-keyring npm...

Malicious code in old-hd-keyring (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76ef85d765687b32fe83742e0a4f907c5d56d21de209f95162b35069a627fdb2 The package old-hd-keyring was found to contain malicious code. Source: ghsa-malware c6b34006e53801700292b4e5ca7b328b4c0bd3c549e7c0d291478c081c7fc735...

MAL-2025-191501 Malicious code in old-hd-keyring (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76ef85d765687b32fe83742e0a4f907c5d56d21de209f95162b35069a627fdb2 The package old-hd-keyring was found to contain malicious code. Source: ghsa-malware c6b34006e53801700292b4e5ca7b328b4c0bd3c549e7c0d291478c081c7fc735...

Legacy Python Bootstrap Scripts Create Domain-Takeover Risk in Multiple PyPI Packages

Cybersecurity researchers have discovered vulnerable code in legacy Python packages that could potentially pave the way for a supply chain compromise on the Python Package Index PyPI via a domain takeover attack. Software supply chain security company ReversingLabs said it found the "vulnerabilit...

CVE-2025-66384

app/Controller/EventsController.php in MISP before 2.5.24 has invalid logic in checking for uploaded file validity, related to tmpname...

PT-2025-48127

In KDE Skanpage before 25.08.0, an attempt at file overwrite can result in the contents of the new file at the beginning followed by the partial contents of the old file at the end, because of use of QIODevice::ReadWrite instead of QODevice::WriteOnly...

CVE-2025-55174

CVE-2025-55174 affects KDE Skanpage prior to 25.08.0. The issue is a file-overwrite condition caused by using QIODevice::ReadWrite instead of QODevice::WriteOnly, which can cause the new file’s contents to appear at the start followed by partial old contents at the end. The vulnerability is local...

CVE-2025-55174

In KDE Skanpage before 25.08.0, an attempt at file overwrite can result in the contents of the new file at the beginning followed by the partial contents of the old file at the end, because of use of QIODevice::ReadWrite instead of QODevice::WriteOnly...

CVE-2025-66017

CGGMP24 is a state-of-art ECDSA TSS protocol that supports 1-round signing requires 3 preprocessing rounds, identifiable abort, and a key refresh protocol. In versions 0.6.3 and prior of cggmp21 and version 0.7.0-alpha.1 of cggmp24, presignatures can be used in the way that significantly reduces...

WordPress ProjectList plugin <= 0.3.0 - Authenticated (Editor+) SQL Injection via 'id' Parameter vulnerability

Authenticated Editor+ SQL Injection via 'id' Parameter vulnerability discovered by Ivan Cese in WordPress Plugin ProjectList versions = 0.3.0...

CVE-2025-64329 affecting package moby-containerd-cc for versions less than 1.7.7-10

CVE-2025-64329 affecting package moby-containerd-cc for versions less than 1.7.7-10. A patched version of the package is available...

TencentOS Server 3: tar (TSSA-2023:0096)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0096 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Google Chrome < 65.0.3325.181 Vulnerability

The version of Google Chrome installed on the remote macOS host is prior to 65.0.3325.181. It is, therefore, affected by a vulnerability as referenced in the 201803stable-channel-update-for-desktop20 advisory. Note that Nessus has not tested for this issue but has instead relied only on the...

SaltStack Salt 安全漏洞

SaltStack Salt is a set of open-source tools developed by SaltStack Corporation for managing infrastructure. This tool offers features such as configuration management and remote execution. There is a security vulnerability in SaltStack Salt, which stems from a degradation of the authentication...

CVE-2024-44641

PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via the oldpass parameter in change-password.php...

SUSE SLED15: binutils / binutils-devel / binutils-devel-32bit / etc (SUSE-SU-2025:4096-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4096-1 advisory. - Do not enable '-z gcs=implicit' on aarch64 for old codestreams. Update to version 2.45: New...

Directus has Improper Permission Handling on Deleted Fields

Summary Directus does not properly clean up field-level permissions when a field is deleted. If a new field with the same name is created later, the system automatically re-applies the old permissions, which can lead to unauthorized access. Details When a field is removed from a collection, its...