MAL-2025-4483 Malicious code in ideals-types (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 01d29c96c89fba87bb3cf0cd09ee9fbca6559fe81267c0e61f61b5c3054b28c0 Any computer that has this package installed or running should be considered...

MAL-2025-4455 Malicious code in vnc-viewer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b409d2b1ea3535147d71ddf23425fe3fe4d437ce0d5af96f32f80c094bccc009 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4446 Malicious code in osuny (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2a422d19cd1a77a3b8c8f23546a8b28a164d923cfef3b4fee3187c2bac2d8b19 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4451 Malicious code in vega-embed-v5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f598c2282a0fd068c54ef02bd7ee8232523d615d6a0144b450e6002b0c95ab5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Clickedu 安全漏洞

Clickedu is an academic management platform from Clickedu, Inc. Clickedu has a security vulnerability that stems from an insecure direct object reference that could lead to information disclosure...

Assimp 安全漏洞

Assimp is an Assimp open source library. It is used to import and export various 3D model formats. A security vulnerability exists in Assimp version 5.4.3, which stems from an out-of-bounds read due to a parameter out operation...

CVE-2024-38889

An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform SQL Injection due to improper neutralization of special elements used in an SQL command...

CVE-2024-3121

A remote code execution vulnerability exists in the createcondaenv function of the parisneo/lollms repository, version 5.9.0. The vulnerability arises from the use of shell=True in the subprocess.Popen function, which allows an attacker to inject arbitrary commands by manipulating the envname and...

CVE-2024-48872

Mattermost versions 10.1.x = 10.1.2, 10.0.x = 10.0.2, 9.11.x = 9.11.4, and 9.5.x = 9.5.12 fail to prevent concurrently checking and updating the failed login attempts. which allows an attacker to bypass of "Max failed attempts" restriction and send a big number of login attempts before being...

CVE-2023-6221

The cloud provider MachineSense uses for integration and deployment for multiple MachineSense devices, such as the programmable logic controller PLC, PumpSense, PowerAnalyzer, FeverWarn, and others is insufficiently protected against unauthorized access. An attacker with access to the internal...

CVE-2023-40219

Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with editor or higher privilege to upload an arbitrary file to an unauthorized directory...

CVE-2023-36817

tktchurch/website contains the codebase for The King's Temple Church website. In version 0.1.0, a Stripe API key was found in the public code repository of the church's project. This sensitive information was unintentionally committed and subsequently exposed in the codebase. If an unauthorized...

MAL-2025-4301 Malicious code in arcademinigame (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6fa9222e0b3e443ffd36e1adeccd80b245382145f0ebdad7b8caf37bdac61b0b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ECOVACS HOME 安全漏洞

ECOVACS HOME is a smart home management software from ECOVACS, China. A security vulnerability exists in ECOVACS HOME 3.3.0 and prior versions, which originates from embedding Alibaba Object Storage Service access keys and secrets, which could lead to sensitive data leakage...

CyberDAVA 安全漏洞

CyberDAVA is a unified platform for managing cyber risk from CyberDAVA, Inc. A security vulnerability exists in CyberDAVA versions prior to 1.1.20 that stems from a lack of access control and could lead to elevated privileges...

PT-2025-22690 · Designthemes · Designthemes Pet World

Name of the Vulnerable Software and Affected Versions: designthemes Pet World versions n/a through 2.8 Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. This can potentially lead to security breaches by injecting malicious objects into the...

PT-2025-22675 · Unknown · Themeton Hotstar – Multi-Purpose Business Theme

Name of the Vulnerable Software and Affected Versions: HotStar – Multi-Purpose Business Theme versions 1.4 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. This can potentially lead to security breaches by injecting malicious objec...

CVE-2021-21253

OnlineVotingSystem is an open source project hosted on GitHub. OnlineVotingSystem before version 1.1.2 hashes user passwords without a salt, which is vulnerable to dictionary attacks. Therefore there is a threat of security breach in the voting system. Without a salt, it is much easier for...

Critical Windows Server 2025 dMSA Vulnerability Enables Active Directory Compromise

A privilege escalation flaw has been demonstrated in Windows Server 2025 that makes it possible for attackers to compromise any user in Active Directory AD. "The attack exploits the delegated Managed Service Account dMSA feature that was introduced in Windows Server 2025, works with the default...

MAL-2025-4183 Malicious code in icloud-sod (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 528df6a9814a12abf16c70b3d096b10babfdae854b8a9952ab8ad5b69790a077 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...