MAL-2025-721 Malicious code in actiris (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ce42694aa8de599a7fc31c85d8c8bd89e7fd57194eb3b657b584a863fdf3402d Any computer that has this package install...

AZL-56351 CVE-2025-21667 affecting package kernel for versions less than 6.6.76.1-1

In the Linux kernel, the following vulnerability has been resolved: iomap: avoid avoid truncating 64-bit offset to 32 bits on 32-bit kernels, iomapwritedelallocscan was inadvertently using a 32-bit position due to folionextindex returning an unsigned long. This could lead to an infinite loop when...

Malicious code in react-native-country-picker-modal-modified (npm)

The package executes harmful command in pre-installation script to send sensitive data to an arbitrary domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 69921c906d4d0ecfa3ba0de532e27f29b18c6be04a563ba99aa0590b1fcc77a8 Any computer that has this package install...

MAL-2025-732 Malicious code in elabasia-mobileapp-react-native-ui (npm)

The package executes harmful command in pre-installation script to send sensitive data to an arbitrary domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ba40a9eda5717392c99efe0516b4a42a0606f1f80cfa4f4887aa56fd0a4eaf93 Any computer that has this package install...

MAL-2025-748 Malicious code in react-native-country-picker-modal-modified (npm)

The package executes harmful command in pre-installation script to send sensitive data to an arbitrary domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 69921c906d4d0ecfa3ba0de532e27f29b18c6be04a563ba99aa0590b1fcc77a8 Any computer that has this package install...

PT-2025-5584 · Acronis · Acronis Cyber Protect Cloud Agent

Name of the Vulnerable Software and Affected Versions: Acronis Cyber Protect Cloud Agent Windows versions prior to build 39378 Description: The issue is related to a local privilege escalation due to a DLL hijacking vulnerability. This means that an attacker could potentially exploit the...

PT-2025-5506 · Unknown · Registrationmagic

Name of the Vulnerable Software and Affected Versions: RegistrationMagic versions prior to 6.0.3.3 Description: The issue is related to improper neutralization of input during web page generation, which allows reflected Cross-site Scripting XSS. This means that an attacker can inject malicious...

MAL-2025-621 Malicious code in org.cocoapods.csv (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a3d922335d96d21629591f3c06d391cc64ca4117561dcb9711fb65451dd841e Any computer that has this package install...

Malicious code in org.cocoapods.csv (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a3d922335d96d21629591f3c06d391cc64ca4117561dcb9711fb65451dd841e Any computer that has this package install...

com.webank.wedatasphere.linkis:linkis-engineplugin-hive (1.0.2), org.apache.hive:hive-pre-upgrade (>=4.0.0-alpha-2, <=4.0.0-beta-1) +3 more potentially affected by CVE-2024-29869 via org.apache.hive:hive-exec (2.3.3)

org.apache.hive:hive-exec MAVEN version 2.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - com.webank.wedatasphere.linkis:linkis-engineplugin-hive 1.0.2 - org.apache.hive:hive-pre-upgrade...

Twig 注入漏洞

Twig is a PHP template engine from Twig open source. An injection vulnerability exists in Twig versions prior to 3.19.0, which stems from the lack of output escaping for expressions to the left of an operator when the operator is used...

PT-2025-5581 · Acronis · Acronis Snap Deploy

Name of the Vulnerable Software and Affected Versions: Acronis Snap Deploy Windows versions before build 4625 Description: The issue is related to local privilege escalation due to insecure folder permissions. This allows for potential exploitation, though specific details about the estimated...

Tandoor Recipes 安全漏洞

Tandoor Recipes is a Tandoor Recipes open source application for managing recipes, planning meals, creating shopping lists, and more. A security vulnerability exists in Tandoor Recipes versions prior to 1.5.28, which stems from an external storage feature that allows any user to enumerate the nam...

PT-2025-4923 · Unknown · Blokhaus Minterpress

Name of the Vulnerable Software and Affected Versions: Blokhaus Minterpress versions n/a through 1.0.5 Description: The issue is related to a lack of authorization in Blokhaus Minterpress, allowing access to functions that are not properly constrained by access control lists ACLs. Recommendations...

CVE-2025-22611 Coolify vulnerable to Privilege Escalation resulting in Remote Command Execution (RCE)

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to escalate his or any other team members privileges to any role, including the owner role. He's also able t...

SonicWall SMA 1000 Series < 12.4.3-02854 Pre-authentication Remote Command Execution (SNWLID-2025-0002)

The remote host is a SonicWall SMA 1000 Series device that may be affected by a pre-authentication remote command execution vulnerability: - Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console AMC and Central Managemen...

CVE-2025-23006

Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console AMC and Central Management Console CMC, which in specific conditions could potentially enable a remote unauthenticated attacker to execute arbitrary OS commands...

PT-2025-4839 · Github · Github

Name of the Vulnerable Software and Affected Versions: matrix-hookshot versions 5.4.1 and earlier matrix-hookshot versions 6.0.1 and earlier Description: The issue is related to a Denial of Service DoS condition that can occur when the software is configured with GitHub support. This happens due ...

PT-2025-3155

Name of the Vulnerable Software and Affected Versions Xerox Workplace Suite versions prior to 5.6.701.9 Description A vulnerability in Xerox Workplace Suite arises from flawed token generation and the use of hard-coded keys. These weaknesses allow attackers to predict or forge tokens, leading to...

CVE-2025-21532

Vulnerability in the Oracle Analytics Desktop product of Oracle Analytics component: Install. Supported versions that are affected are Prior to 8.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Analytics Desktop executes to...