MAL-2025-47339 Malicious code in pm2-gelf-json (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9729db241544847eced07c28de82e8cd2a4432b69f44d56de0289ab621fc1492 Any computer that has this package installed or running should be considered fully compromised. All...

Self-Replicating Worm Hits 180+ Software Packages

At least 187 code packages made available through the JavaScript repository NPM have been infected with a self-replicating worm that steals credentials from developers and publishes those secrets on GitHub , experts warn. The malware, which briefly infected multiple code packages from the securit...

MAL-2025-47210 Malicious code in swc-plugin-component-annotate (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 65e72154327975b96053186a0016efcacea667730e163b10f507b40b94254047 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47169 Malicious code in @nstudio/xplat (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 428f67f5c50b5dde563748444f509f1f52d4c606edea886a1906b387cf40198a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-6999 WatchGuard Firebox Authentication Portal Request Smuggling Vulnerability

An HTTP Request Smuggling CWE-444 vulnerability in the Authentication portal of WatchGuard Fireware OS allows a remote attacker to evade request parameter sanitation and perform a reflected self-Cross-Site Scripting XSS attack. WatchGuard does not believe there is a practical exploit chain with a...

CVE-2025-58434

Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5 and earlier, the forgot-password endpoint in Flowise returns sensitive information including a valid password reset tempToken without authentication or verification. This enables any attacker...

CVE-2025-58434 Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover

Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5 and earlier, the forgot-password endpoint in Flowise returns sensitive information including a valid password reset tempToken without authentication or verification. This enables any attacker...

PT-2025-37340

Name of the Vulnerable Software and Affected Versions Flowise versions 3.0.5 and earlier Description The forgot-password endpoint returns sensitive information, including a valid password reset tempToken, without requiring authentication or verification. This allows a remote attacker to generate ...

Malicious code in @self-sell/store (npm)

The package @self-sell/store was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5a25554db33ac217aa1afe6e461f5ec9429746b8c3071523cbea2987e8cdc04e Any computer that has this package installed or running should be considered fully...

Malicious code in @self-sell/guards (npm)

The package @self-sell/guards was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 594bf67cf504a8b4b9f076c7913f69f5a9b3f0677a7528de143d2b247cf3bff7 Any computer that has this package installed or running should be considered fully...

MAL-2025-47045 Malicious code in @self-sell/guards (npm)

The package @self-sell/guards was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 594bf67cf504a8b4b9f076c7913f69f5a9b3f0677a7528de143d2b247cf3bff7 Any computer that has this package installed or running should be considered fully...

MAL-2025-47046 Malicious code in @self-sell/self-sell-amplitude-events (npm)

The package @self-sell/self-sell-amplitude-events was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ae064f7137baf9c1292997ecd4204537d8011af89721c3d0878247049cd7a20f Any computer that has this package installed or running should be...

Malicious code in @self-sell/self-sell-amplitude-events (npm)

The package @self-sell/self-sell-amplitude-events was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ae064f7137baf9c1292997ecd4204537d8011af89721c3d0878247049cd7a20f Any computer that has this package installed or running should be...

Malicious Package

Overview @self-sell/store is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in @self-sell/components (npm)

The package @self-sell/components was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aeb15f4ae1c1a830e2fdc21bd8a903fe2e14978eb9952f1e5b3f98f0ca7f353f Any computer that has this package installed or running should be considered fully...

MAL-2025-47047 Malicious code in @self-sell/store (npm)

The package @self-sell/store was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5a25554db33ac217aa1afe6e461f5ec9429746b8c3071523cbea2987e8cdc04e Any computer that has this package installed or running should be considered fully...

MAL-2025-47044 Malicious code in @self-sell/components (npm)

The package @self-sell/components was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aeb15f4ae1c1a830e2fdc21bd8a903fe2e14978eb9952f1e5b3f98f0ca7f353f Any computer that has this package installed or running should be considered fully...

Security Updates for Microsoft Visio Products C2R (September 2025)

The Microsoft Visio Products are missing a security update. It is, therefore, affected by a remote code execution vulnerability that attackers can exploit to bypass authentication and execute unauthorized arbitrary commands. Note that Nessus has not tested for this issue but has instead relied on...

CVE-2025-36854

A vulnerability CVE-2024-38229 https://www.cve.org/CVERecord exists in EOL ASP.NET when closing an HTTP/3 stream while application code is writing to the response body, a race condition may lead to use-after-free, resulting in Remote Code Execution. Per CWE-416: Use After Free...

Linux Distros Unpatched Vulnerability : CVE-2020-14321

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, teachers of a course were able to assign themselves the manager role within that course. CVE-2020-14321 Note th...