AZL-71125 CVE-2025-12816 affecting package reaper for versions less than 3.1.1-21

An interpretation-conflict CWE-436 vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions...

A week in security (October 20 – October 26)

Last week on Malwarebytes Labs: Is AI moving faster than its safety net? Thousands of online stores at risk as SessionReaper attacks spread Apple may have to open its walled garden to outside app stores Meta boosts scam protection on WhatsApp and Messenger Home Depot Halloween phish gives users a...

Over 250 Magento Stores Hit Overnight as Hackers Exploit New Adobe Commerce Flaw

E-commerce security company Sansec has warned that threat actors have begun to exploit a recently disclosed security vulnerability in Adobe Commerce and Magento Open Source platforms, with more than 250 attack attempts recorded against multiple stores over the past 24 hours. The vulnerability in...

Magento SessionReaper

This module exploits CVE-2025-54236 SessionReaper, a critical vulnerability in Magento/Adobe Commerce that allows unauthenticated remote code execution. The vulnerability stems from improper handling of nested deserialization in the payment method context, combined with an unauthenticated file...

EUVD-2018-1875

Malware in sbrugna...

GHSA-3P8M-J85Q-PGMJ vulnerabilities

Vulnerabilities for packages: kserve-modelmesh, logstash-input-http, apicurio-registry, zipkin, zookeeper, druid, flyway, elasticsearch-fips, solr, opensearch, knative-kafka-broker, management-api-for-apache-cassandra-5.0, trino, elasticsearch, infinispan, grpc-java-fips, wavefront-proxy, wildfly...

AZL-66570 CVE-2025-9288 affecting package reaper 3.1.1-22

Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11...

atjiu pybbs 6.0.0 - Cross Site Scripting (XSS)

/ Exploit Title : atjiu pybbs 6.0.0 - Cross Site Scripting XSS Exploit Author: Byte Reaper Vendor Homepage: https://github.com/atjiu/pybbs Tested on: Kali Linux CVE: CVE-2025-8550...

Exploit for CVE-2025-7766

CVE-2025-7766 PoC Exploit PoC for exploiting XML External Ent...

CVE-2025-48924 vulnerabilities

Vulnerabilities for packages: airflow, maven-stage0, solr, sonar-scanner-cli, management-api-for-apache-cassandra-5.0, keycloak-config-cli, celeborn, dependency-track, kserve-modelmesh, spark, akhq, apicurio-registry, cassandra-reaper, gradle, thingsboard, cassandra, nextflow, apache-nifi-registr...

GHSA-J288-Q9X7-2F5V vulnerabilities

Vulnerabilities for packages: airflow, maven-stage0, solr, sonar-scanner-cli, management-api-for-apache-cassandra-5.0, keycloak-config-cli, celeborn, dependency-track, kserve-modelmesh, spark, akhq, apicurio-registry, cassandra-reaper, gradle, thingsboard, cassandra, nextflow, apache-nifi-registr...

GHSA-J288-Q9X7-2F5V vulnerabilities

Vulnerabilities for packages: kserve-modelmesh, airflow, gradle, apicurio-registry, spdx-tools-java, zipkin, druid, flyway, apache-tika, elasticsearch-fips, jenkins-plugin-manager, liquibase, solr, opensearch, management-api-for-apache-cassandra-5.0, elasticsearch, apache-nifi, infinispan,...

CBL Mariner 2.0 Security Update: reaper (CVE-2024-6484)

The version of reaper installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-6484 advisory. - A vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting XSS attacks. The...

CBL Mariner 2.0 Security Update: reaper (CVE-2025-48387)

The version of reaper installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-48387 advisory. - tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue...

CVE-2024-6484 affecting package reaper for versions less than 3.1.1-19

CVE-2024-6484 affecting package reaper for versions less than 3.1.1-19. A patched version of the package is available...

CVE-2025-48387 affecting package reaper for versions less than 3.1.1-19

CVE-2025-48387 affecting package reaper for versions less than 3.1.1-19. A patched version of the package is available...

CVE-2025-52999 vulnerabilities

Vulnerabilities for packages: tez, cassandra, spark, confluent-common-docker, druid, gradle-stage0, scala, cassandra-reaper...

GHSA-H46C-H94J-95F3 vulnerabilities

Vulnerabilities for packages: tez, cassandra, spark, confluent-common-docker, druid, gradle-stage0, scala, cassandra-reaper...

AZL-62236 CVE-2025-48387 affecting package reaper for versions less than 3.1.1-19

tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaround, use the ignore option to ignore n...

CVE-2025-48734 vulnerabilities

Vulnerabilities for packages: tez, celeborn, wildfly, apicurio-registry, apache-activemq-artemis, strimzi-kafka-operator, confluent-common-docker, druid, apache-nifi, jenkins-plugin-manager, jenkins, trino, opensearch, spdx-tools-java, akhq, sonarqube, cassandra-reaper...