MAL-2025-17362 Malicious code in com.unity.render-pipelines.universal (npm)

The package com.unity.render-pipelines.universal was found to contain malicious code...

MAL-2025-17016 Malicious code in cicada-render (npm)

The package cicada-render was found to contain malicious code...

Malicious code in com.unity.render-pipelines.core (npm)

The package com.unity.render-pipelines.core was found to contain malicious code...

MAL-2025-32073 Malicious code in render-loop (npm)

The package render-loop was found to contain malicious code...

formii (=1.0.0), html-patcher-stream (>=1.0.0 <=1.1.0) +1 more potentially affected by unknown CVE via html-patcher (>=0.0.3 <=0.1.0)

html-patcher NPM version =0.0.3, =1.0.0, =0.1.0, =1.0.0 Source cves: unknown CVE Source advisory: OSV:MAL-2025-22751...

MAL-2025-39034 Malicious code in webpack-sever-render-middleware (npm)

The package webpack-sever-render-middleware was found to contain malicious code...

MAL-2025-17361 Malicious code in com.unity.render-pipelines.core (npm)

The package com.unity.render-pipelines.core was found to contain malicious code...

Linux Distros Unpatched Vulnerability : CVE-2021-29952

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When Web Render components were destructed, a race condition could have caused undefined behavior, and we presume that with enough effort may have been...

Linux Distros Unpatched Vulnerability : CVE-2024-32875

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.125.3, title arguments in Markdown for links and images not escaped in...

Linux Distros Unpatched Vulnerability : CVE-2015-3231

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Render cache system in Drupal 7.x before 7.38, when used to cache content by user role, allows remote authenticated users to obtain private content viewed b...

xorg-x11-server: Use-after-free in ProcRenderAddGlyphs

A use-after-free vulnerability was found in the ProcRenderAddGlyphs function of Xorg servers. This issue occurs when AllocateGlyph is called to store new glyphs sent by the client to the X server, potentially resulting in multiple entries pointing to the same non-refcounted glyphs. Consequently,...

webkitgtk: heap-use-after-free in WebCore::RenderLayer::addChild()

A use-after-free vulnerability in WebCore::RenderLayer::addChild in WebKitGTK before 2.36.8 allows attackers to execute code remotely...

Progress多款产品 跨站脚本漏洞

Progress Telerik UI for ASP.NET Core and others are products of Progress, Inc.Progress Telerik UI for ASP.NET Core is a set of UI component libraries for building cross-platform responsive web applications.Progress Telerik UI for Progress Telerik UI for ASP.NET MVC is a library of UI components f...

CVE-2025-20297

In Splunk Enterprise versions below 9.4.2, 9.3.4 and 9.2.6, and Splunk Cloud Platform versions below 9.3.2411.102, 9.3.2408.111 and 9.2.2406.118, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload through the pdfgen/render REST endpoint th...

Splunk Cloud Platform和Splunk Enterprise 跨站脚本漏洞

Splunk Cloud Platform and Splunk Enterprise are both products of Splunk, Inc. of the U.S. Splunk Cloud Platform is a powerful data collection, processing, and analytics service.Splunk Enterprise is a suite of data collection and analytics software. A cross-site scripting vulnerability exists in...

CVE-2024-30920

Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the render-document.php component...

CVE-2024-10360

The Move Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.5 via the render function in includes/widgets/accordion/widget.php, includes/widgets/remote-template/widget.php, and other widget.php files. This makes it...

CVE-2024-55657

SiYuan is a personal knowledge management system. Prior to version 3.1.16, an arbitrary file read vulnerability exists in Siyuan's /api/template/render endpoint. The absence of proper validation on the path parameter allows attackers to access sensitive files on the host system. Version 3.1.16...

Malicious code in com.unity.renderstreaming (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware db96f5b3a2ace783068fe773607e8b9894aad6bc2becaa443b4f8cceba9b033f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the Git-based software platform for collaborative code development on GitLab EE/CE lies in insufficient data cleansing, which allows attackers to carry out XSS attacks.

The vulnerability of the Git-based software platform for collaborative code development in GitLab EE/CE relates to insufficient cleaning of data provided by users in the Asciidoctor render. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...