CVE-2025-10894 Nx: nx/devkit: malicious versions of nx and plugins published to npm

Malicious code was inserted into the Nx build system package and several related plugins. The tampered package was published to the npm software registry, via a supply-chain attack. Affected versions contain code that scans the file system, collects credentials, and posts them to GitHub as a repo...

CVE-2025-59828

Claude Code is an agentic coding tool. Prior to Claude Code version 1.0.39, when using Claude Code with Yarn versions 2.0+, Yarn plugins are auto-executed when running yarn --version. This could lead to a bypass of the directory trust dialog in Claude Code, as plugins would be executed prior to t...

CVE-2025-59828 Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn Versions

Claude Code is an agentic coding tool. Prior to Claude Code version 1.0.39, when using Claude Code with Yarn versions 2.0+, Yarn plugins are auto-executed when running yarn --version. This could lead to a bypass of the directory trust dialog in Claude Code, as plugins would be executed prior to t...

PT-2025-39338

Name of the Vulnerable Software and Affected Versions Claude Code versions prior to 1.0.39 Description Claude Code is an agentic coding tool. When used with Yarn versions 2.0 and higher, Yarn plugins are automatically executed when running yarn --version in versions prior to 1.0.39. This could...

CVE-2025-8410

Use After Free vulnerability in RTI Connext Professional Security Plugins allows File Manipulation.This issue affects Connext Professional: from 7.5.0 before 7.6.0...

CVE-2025-8410

Use After Free vulnerability in RTI Connext Professional Security Plugins allows File Manipulation.This issue affects Connext Professional: from 7.5.0 before 7.6.0...

CVE-2025-8410 Use After Free vulnerability in RTI Connext Professional (Security Plugins) allows File Manipulation.

Use After Free vulnerability in RTI Connext Professional Security Plugins allows File Manipulation.This issue affects Connext Professional: from 7.5.0 before 7.6.0...

CVE-2025-8410 Use After Free vulnerability in RTI Connext Professional (Security Plugins) allows File Manipulation.

Use After Free vulnerability in RTI Connext Professional Security Plugins allows File Manipulation.This issue affects Connext Professional: from 7.5.0 before 7.6.0...

CVE-2025-8410

This CVE concerns RTI Connext Professional (Security Plugins). A Use After Free vulnerability in the Security Plugins component may allow file manipulation. Affected versions are Connext Professional 7.5.0 up to, but not including, 7.6.0. The issue stems from a post-release reuse/management flaw ...

PT-2025-39201

Name of the Vulnerable Software and Affected Versions RTI Connext Professional versions 7.5.0 through 7.5.9 Description A Use After Free issue exists in RTI Connext Professional Security Plugins that could allow File Manipulation. The issue is present in the Security Plugins component...

Security update for gstreamer-plugins-base

This update for gstreamer-plugins-base fixes the following issues: CVE-2025-47806: Fixed stack buffer overflow in SubRip subtitle parser bsc1244407. CVE-2025-47807: Fixed NULL-pointer dereference in SubRip subtitle parser bsc1244403. CVE-2025-47808: Fixed NULL-pointer dereference in TMPlayer...

SUSE-SU-2025:20751-1 Security update for gstreamer-plugins-base

This update for gstreamer-plugins-base fixes the following issues: - CVE-2025-47806: Fixed stack buffer overflow in SubRip subtitle parser bsc1244407. - CVE-2025-47807: Fixed NULL-pointer dereference in SubRip subtitle parser bsc1244403. - CVE-2025-47808: Fixed NULL-pointer dereference in TMPlaye...

PT-2025-38798

Name of the Vulnerable Software and Affected Versions e-plugins Directory Pro versions through 2.5.5 Description The software contains a flaw related to improper input handling during web page generation, leading to a DOM-Based Cross-site Scripting issue. This allows for potential malicious code...

Build Numbers and Versions of Veeam Plug-in for Scale Computing HyperCore

This KB article lists all versions of the Veeam Plug-in for Scale Computing HyperCore and their respective worker build numbers. Version | Plug-In / Worker Build | Release Date ---|---|--- Veeam Plug-in for Scale Computing HyperCore 4 Releases Veeam Plug-in for Scale Computing HyperCore 4.0...

CVE-2025-9079

Mattermost versions 10.8.x = 10.8.3, 10.5.x = 10.5.8, 9.11.x = 9.11.17, 10.10.x = 10.10.1, 10.9.x = 10.9.3 fail to validate import directory path configuration which allows admin users to execute arbitrary code via malicious plugin upload to prepackaged plugins directory...

CVE-2025-8565

The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on the wplpgdprinstallpluginajaxhandler function in all versions up to, and including, 3.4.3...

CVE-2023-49565

The cbismanager Podman container is vulnerable to remote command execution via the /api/plugins endpoint. Improper sanitization of the HTTP Headers X-FILENAME, X-PAGE, and X-FIELD allows for command injection. These headers are directly utilized within the subprocess.Popen Python function without...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via improper validation of the import directory path configuration. An attacker can execute arbitrary code by uploading a malicious plugin to the prepackaged plugins directory. This is only exploitable if the attacke...

Mattermost Path Traversal vulnerability

Mattermost versions 10.8.x = 10.8.3, 10.5.x = 10.5.8, 9.11.x = 9.11.17, 10.10.x = 10.10.1, 10.9.x = 10.9.3 fail to validate import directory path configuration which allows admin users to execute arbitrary code via malicious plugin upload to prepackaged plugins directory...

GHSA-QX3F-6VQ3-8J8M Mattermost Path Traversal vulnerability

Mattermost versions 10.8.x = 10.8.3, 10.5.x = 10.5.8, 9.11.x = 9.11.17, 10.10.x = 10.10.1, 10.9.x = 10.9.3 fail to validate import directory path configuration which allows admin users to execute arbitrary code via malicious plugin upload to prepackaged plugins directory...