CVE-2025-9524

CVE-2025-9524 affects Axis VAPIX API port.cgi. Root cause: insufficient input validation in port.cgi, leading to process crashes and potential availability impact. Exploitation requires authentication with a viewer/operator/admin service account. CVSS~3.1: 4.3 (NETWORK, LOW attacker interaction, ...

CVE-2025-11855 Age Restriction <= 3.0.2 - Subscriber+ Privilege Escalation

The age-restriction WordPress plugin through 3.0.2 does not have authorisation in the agerestrictionRemoteSupportRequest function, allowing any authenticated users, such as subscriber to create an admin user with a hardcoded username and arbitrary password...

EUVD-2025-73977

Malicious code in requiredgoldfishz3n npm...

EUVD-2025-73979

Malicious code in requiredalbatrossz3n npm...

EUVD-2025-67319

Malicious code in requiredfalconz3n npm...

CVE-2025-12658 Preload Current Images <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Preload Current Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'complete' parameter in the 'preloadprogressbar' shortcode in all versions up to, and including, 1.3. This is due to insufficient input sanitization and output escaping on user supplied attributes...

WordPress The Total Book Project plugin <= 1.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Book Manipulation vulnerability

Insecure Direct Object Reference to Authenticated Contributor+ Book Manipulation vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin The Total Book Project versions = 1.0...

EUVD-2025-52315

Malicious code in required-amaranth-moth npm...

EUVD-2025-52314

Malicious code in required-azure-possum npm...

Malicious code in required-azure-possum (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e5770ca3e2f6346ea16e82c0218a69932c3fe4d26a7e8597e9f29af33d373e3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-52313

Malicious code in required-chocolate-skunk npm...

EUVD-2025-52311

Malicious code in required-crimson-woodpecker npm...

EUVD-2025-52308

Malicious code in required-purple-quokka npm...

EUVD-2025-52312

Malicious code in required-crimson-tyrannosaurus npm...

EUVD-2025-52309

Malicious code in required-harlequin-earwig npm...

EUVD-2025-52310

Malicious code in required-cyan-tarsier npm...

MAL-2025-70338 Malicious code in required-crimson-woodpecker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dad3aade4d35b72d700887154ebe8dbf30d2f68a812e0b537ee05e692e739f61 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

PT-2025-46447

Name of the Vulnerable Software and Affected Versions InDesign Desktop versions 20.5, 19.5.5 and earlier Description InDesign Desktop versions 20.5, 19.5.5 and earlier are susceptible to a Heap-based Buffer Overflow. Successful exploitation of this issue could lead to arbitrary code execution wit...

PT-2025-46527

Name of the Vulnerable Software and Affected Versions Format Plugins versions 1.1.1 and earlier Description Format Plugins versions 1.1.1 and earlier are susceptible to an Out-of-bounds Read issue, potentially leading to memory exposure. An attacker could exploit this to disclose sensitive...

Zoom Workplace VDI Client < 6.3.14 Vulnerability (ZSB-25044)

The version of Zoom Workplace VDI Client installed on the remote host is prior to 6.3.14. It is, therefore, affected by a vulnerability as referenced in the ZSB-25044 advisory. - Improper certificate validation in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of...