EUVD-2025-175632

Malicious code in water-user-fast-sanitize-test npm...

EUVD-2025-176988

Malicious code in protected-table-sanitize-secure-void npm...

EUVD-2025-179028

Malicious code in eta-proxy-omicron-theta-sanitize npm...

MAL-2025-189346 Malicious code in sanitize-eta-promise-error-awk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e00d20cc45b0c3561f876e2907c05759af75b6ae061f01d2d3240a3aefde578d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-176530

Malicious code in sanitize-analyze-benchmark-deploy-encode npm...

MAL-2025-190244 Malicious code in water-user-fast-sanitize-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17601b4893c68eab5aeef268b3e08ec5b4809b4f32300ca5ce4cfbf32c530150 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187281 Malicious code in hash-authorize-sanitize-signal-cloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6036f529790af1d972ea5481f35974ed1ddef51980d2dfd257f1206670838669 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-179590

Malicious code in container-error-sanitize-authenticate-sigma npm...

kernel: io_uring: prevent opcode speculation

In the Linux kernel, the following vulnerability has been resolved: iouring: prevent opcode speculation sqe-opcode is used for different tables, make sure we santitise it against speculations...

PT-2025-46176

Name of the Vulnerable Software and Affected Versions Tenda AC18 version 15.03.05.05 multi Description A stored cross-site scripting XSS issue exists in Tenda AC18. The issue is located in the ssid parameter within the wireless settings. An attacker can inject malicious payloads that will execute...

CVE-2025-64494 Soft Serve does not sanitize ANSI escape sequences in user input

Soft Serve is a self-hostable Git server for the command line. In versions prior to 0.10.0, there are several places where the user can insert data e.g. names and ANSI escape sequences are not being removed, which can then be used, for example, to show fake alerts. In the same token, git messages...

GHSA-VFPF-XMWH-8M65 Duplicate Advisory: ProsemirrorToHtml has a Cross-Site Scripting (XSS) vulnerability through unescaped HTML attribute values

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-52c5-vh7f-26fx. This link is maintained to preserve external references. Original Description Impact The prosemirrortohtml gem is vulnerable to Cross-Site Scripting XSS attacks through malicious HTML attribute...

Duplicate Advisory: ProsemirrorToHtml has a Cross-Site Scripting (XSS) vulnerability through unescaped HTML attribute values

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-52c5-vh7f-26fx. This link is maintained to preserve external references. Original Description Impact The prosemirrortohtml gem is vulnerable to Cross-Site Scripting XSS attacks through malicious HTML attribute...

CLSA-2025-1762421346 mod_security: Fix of CVE-2025-47947

CVE-2025-47947: fix potential DoS by adding ARGS to the sanitize list only if it's not added yet...

Uncontrolled Recursion

express-xss-sanitizer is vulnerable to uncontrolled recursion. The vulnerability is due to an unbounded recursion depth in the sanitize function in lib/sanitize.js when processing a JSON request body, which allows an attacker to cause a denial of service by triggering infinite recursion...

PT-2025-44632

Name of the Vulnerable Software and Affected Versions BEO GmbH BEO Atlas Einfuhr Ausfuhr version 3.0 Description A reflected cross-site scripting XSS issue exists in BEO GmbH BEO Atlas Einfuhr Ausfuhr 3.0. This allows attackers to execute arbitrary code within a user’s browser. Exploitation occur...

CVE-2025-54384

CKAN is affected by a stored XSS vulnerability in the helpers.markdown_extract() function. Before versions 2.10.9 and 2.11.4, user-provided data rendered on dataset/resource/organization/group pages could be wrapped in an HTML literal without sufficient sanitization, enabling an XSS vector. The i...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the SharpShowTextField component when rendering user-supplied input containing Vue template syntax. An attacker can execute arbitrary JavaScript or inject malicious HTML by submitting specially crafted...

CVE-2025-12203

A weakness has been identified in givanz Vvveb up to 1.0.7.3. This issue affects the function sanitizeFileName of the file system/functions.php of the component Code Editor. Executing a manipulation of the argument File can lead to path traversal. The attack can be launched remotely. The exploit...

EUVD-2025-36065

A weakness has been identified in givanz Vvveb up to 1.0.7.3. This issue affects the function sanitizeFileName of the file system/functions.php of the component Code Editor. Executing manipulation of the argument File can lead to path traversal. The attack can be launched remotely. The exploit ha...