QNAP QTS和QNAP QuTS hero 路径遍历漏洞

QNAP QTS is a NAS operating system developed by QNAPSystems, Inc. designed for network attached storage devices, providing data management, backup, multimedia entertainment, etc. QNAP QuTS hero is an enterprise-grade operating system developed by QNAP for its networked storage devices NAS, which ...

lychee link checking action affected by arbitrary code injection in composite action

Summary There is a potential attack of arbitrary code injection vulnerability in lychee-setup of the composite action at action.yml. Details The GitHub Action variable inputs.lycheeVersion can be used to execute arbitrary code in the context of the action. PoC yaml - uses: lycheeverse/lychee@v2...

Malicious code in g-profiler (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-41474 Malicious code in @twork-data-services/company-accounts (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in web5 (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in rblxsetup (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in easy-https (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in decoratoroperations (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-41630 Malicious code in certiffi (PyPI)

--- -= Per source details. Do not edit below this line.=-...

IBM Cognos Command Center Redirection Vulnerability

IBM Cognos Command Center is a solution for automating business processes that simplifies operational complexity across multiple software environments by allowing users to view, execute and monitor automated processes through a single interface. A redirection vulnerability exists in IBM Cognos...

GHSA-P9W7-82W4-7Q8M Picklescan is missing detection when calling built-in python lib2to3.pgen2.pgen.ParserGenerator.make_label

Summary Using lib2to3.pgen2.pgen.ParserGenerator.makelabel function, which is a built-in python library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to...

Malicious code in @espace-client-axafr/skeleton (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in @espace-client-axafr/lme (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in @espace-client-axafr/redirection-angel (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in @espace-client-axafr/latest-reimbursements (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-41883 Malicious code in @espace-client-axafr/popin-resilience (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in @espace-client-axafr/chat-genesys-auth (npm)

The package communicates with a domain associated with malicious activity...

CVE-2025-54482

CVE-2025-54482 affects The Biosig Project libbiosig 3.9.0 and the Master branch (commit 35a819fa). A stack-based buffer overflow in the MFER parsing functionality can allow arbitrary code execution when processing a malicious MFER file. The vulnerability is manifested in biosig.c at line 8751 (ta...

Exploit for CVE-2025-60739

ilevia-EVE-X1-Server-CSRF ilevia EVE X1 Server /bhwebbackend...

hippo4j Includes Hard Coded Secret Key in JWT Creation

hippo4j 1.0.0 to 1.5.0, uses a hard-coded secret key in its JWT JSON Web Token creation. This allows attackers with access to the source code or compiled binary to forge valid access tokens and impersonate any user, including privileged ones such as "admin". The vulnerability poses a critical...