Exploit for CVE-2025-59396

PoC exploit for CVE-2025-59396, an exploit targeting a default c...

EUVD-2025-37364

On a client with an admin user, a GlobalShipping script can be implemented. The script could later be executed on the BRAIN2 server with administrator rights...

CVE-2025-12460

An XSS issue was discovered in Afterlogic Aurora webmail version 9.8.3 and below. An attacker can send a specially crafted HTML e-mail message with JavaScript in an img HTML tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window...

Unbounded allocation when parsing GNU sparse map in archive/tar

...

Malicious Package

Overview soxhob-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in epic-common-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8e76e853a5ddeb0b5baed9270a0858d1df0976691cfd336b223e8208c241371 The package epic-common-node was found to contain malicious code...

EUVD-2025-36995

Apache Airflow's create action can upsert existing Pools/Connections/Variables...

MAL-2025-48971 Malicious code in @msdyn365-commerce-marketplace/tax-registration-numbers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 71449dcdb918b9b8c54b5420fd4cd57a99e84a172a53b0725bb39e1f6591b7bb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview airbnb-bev is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview ts-important-stuff is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview durablefunctionsmonitor.react is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview durablefunctionsmonitor-vscodeext is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious code in spaintest1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2104fbcce90cd97dbee8fa4f047b5bc21a8b2eb1009654e1d6e6542f95b9ed8d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2025-36646

Jenkins Curseforge Publisher Plugin does not mask API Keys displayed on the job configuration form...

GHSA-HV42-CRPX-Q355 Jenkins Curseforge Publisher Plugin does not mask API Keys displayed on the job configuration form

Jenkins Curseforge Publisher Plugin 1.0 and earlier stores API Keys unencrypted in job config.xml files on the Jenkins controller as part of its configuration. These keys can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. Additionally, the j...

CVE-2025-10561

The device is running an outdated operating system, which may be susceptible to known vulnerabilities...

CVE-2025-59151

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interface before 6.3 is vulnerable to Carriage Return Line Feed CRLF injection. When a request is made to a file ending with the .lp extension, t...

‘ChatGPT Tainted Memories’ Exploit Enables Command Injection in Atlas Browser

LayerX Security found a flaw in OpenAI’s ChatGPT Atlas browser that lets attackers inject commands into its memory, posing major security and phishing risks...

CVE-2025-10561

Rejected reason: This CVE ID was assigned in error. The End-of-Life status of a component, by itself, does not constitute a vulnerability under the CVE Program’s rules. This condition represents a security weakness CWE-1104: Use of Unmaintained Third-Party Components rather than a specific...

EUVD-2025-36150

The system is deployed in its default state, with configuration settings that do not comply with the latest best practices for restricting access. This increases the risk of unauthorised connections...