MAL-2025-43901 Malicious code in cosmicsilence-nightwatch-wavefunction-rest (npm)

The package cosmicsilence-nightwatch-wavefunction-rest was found to contain malicious code...

Malicious code in rest-hugo-dactyl-kastra (npm)

The package rest-hugo-dactyl-kastra was found to contain malicious code...

Malicious code in rest-changelog-mini-css-extract-plugin-eslint-plugin (npm)

The package rest-changelog-mini-css-extract-plugin-eslint-plugin was found to contain malicious code...

Malicious code in regulus-elara-rest-triton (npm)

The package regulus-elara-rest-triton was found to contain malicious code...

MAL-2025-43521 Malicious code in asteroid-quito-child-process-rest (npm)

The package asteroid-quito-child-process-rest was found to contain malicious code...

MAL-2025-46662 Malicious code in xanthus-rest-package-rocket (npm)

The package xanthus-rest-package-rocket was found to contain malicious code...

MAL-2025-44284 Malicious code in flight-rest-successful (npm)

The package flight-rest-successful was found to contain malicious code...

CVE-2025-58459

Jenkins global-build-stats Plugin 322.v22f4db18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attackers with Overall/Read permission to enumerate graph IDs...

CVE-2025-55739

api is a module for FreePBX@, which is an open source GUI that controls and manages Asterisk© PBX. In versions lower than 15.0.13, 16.0.2 through 16.0.14, 17.0.1 and 17.0.2, there is an identical OAuth private key used across multiple systems that installed the same FreePBX RPM or DEB package. An...

CVE-2025-55739

api is a module for FreePBX@, which is an open source GUI that controls and manages Asterisk© PBX. In versions lower than 15.0.13, 16.0.2 through 16.0.14, 17.0.1 and 17.0.2, there is an identical OAuth private key used across multiple systems that installed the same FreePBX RPM or DEB package. An...

VulnCheck KEV: CVE-2025-29925

XWiki Platform is a generic wiki platform. Prior to 15.10.14, 16.4.6, and 16.10.0-rc-1, protected pages are listed when requesting the REST endpoints /rest/wikis/wikiName/pages even if the user doesn't have view rights on them. It's particularly true if the entire wiki is protected with "Prevent...

CVE-2025-8268

The AI Engine plugin for WordPress is vulnerable to unauthorized access and loss of data due to a missing capability check on the restlist and deletefiles functions in all versions up to, and including, 2.9.5. This makes it possible for unauthenticated attackers to list and delete files uploaded ...

CVE-2025-8268

The CVE-2025-8268 entry concerns the WordPress AI Engine plugin (versions up to 2.9.5) with a missing capability check in the rest_list and delete_files paths, enabling unauthenticated attackers to list and delete files uploaded by other users. Impact per sources: unauthorized access and data los...

Missing Authorization

Overview org.jenkins-ci.plugins:global-build-stats is a global-build-stats plugin Affected versions of this package are vulnerable to Missing Authorization via the REST API endpoints, which do not perform permission checks. An attacker can enumerate graph IDs by sending requests with only...

GHSA-GM8G-FH49-QQ6V Jenkins global-build-stats Plugin missing permission check can result in graph IDs being enumerated

Jenkins global-build-stats Plugin 322.v22f4db18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attackers with Overall/Read permission to enumerate graph IDs. This has been patched in version 347.v32aeb0493c4f...

CVE-2025-58459

Jenkins global-build-stats Plugin 322.v22f4db18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attackers with Overall/Read permission to enumerate graph IDs...

CVE-2025-58459

Jenkins global-build-stats Plugin 322.v22f4db18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attackers with Overall/Read permission to enumerate graph IDs...

PT-2025-35781

Name of the Vulnerable Software and Affected Versions: Jenkins global-build-stats Plugin versions 322.v22f4db 18e2dd and earlier Description: The Jenkins global-build-stats Plugin does not perform permission checks in its REST API endpoints. Attackers with Overall/Read permission can enumerate...

Jenkins plugins Multiple Vulnerabilities (2025-09-03)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - In Jakarta Mail 2.0.2 it is possible to preform a SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages...

Linux Distros Unpatched Vulnerability : CVE-2014-5459

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The PEARREST class in REST.php in PEAR in PHP through 5.6.0 allows local users to write to arbitrary files via a symlink attack on a 1 rest.cachefile or 2...