org.sakaiproject.scheduler:scheduler-assembly (>=2.9.0-b03, <=2.9.3), org.sakaiproject.scheduler:scheduler-test-component-shared (>=2.9.0-b03, <=23.3) +2 more potentially affected by CVE-2025-62710 via org.sakaiproject.scheduler:scheduler-component-shared (>=2.9.0, <=23.3)

org.sakaiproject.scheduler:scheduler-component-shared MAVEN version =2.9.0, =2.9.0-b03, =2.9.0-b03, =2.9.0-b03, =2.3.0-b03, =11.4 Source cves: CVE-2025-62710 Source advisory: SNYK:JAVA-ORGSAKAIPROJECTSCHEDULER-13669872...

Unverified Ownership

Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Unverified Ownership via the JWT authentication process. An attacker can gain unauthorized access to protected resources by presenting a valid token intended for a different audience when...

CVE-2023-53723

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: disable sdma ecc irq only when sdma RAS is enabled in suspend sdmav40ip is shared on a few asics, but in sdmav40hwfini, driver unconditionally disables eccirq which is only enabled on those asics enabling sdma ecc. Th...

PT-2026-2610

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw related to IOMMU Shared Virtual Addressing SVA. The kernel lacks a mechanism to notify the IOMMU of changes to kernel page tables when pages are freed an...

SAMSUNG Notes Information Disclosure Vulnerability

SAMSUNG Notes is a software application from Samsung South Korea. It is used to provide a record function. SAMSUNG Notes has an information disclosure vulnerability that can be exploited by an attacker to access shared notes...

WordPress OwnID Passwordless Login plugin authentication bypass vulnerability

WordPress OwnID Passwordless Login plugin is a WordPress plugin for passwordless login function, by sending a one-time authorization code to the user's email or cell phone to complete the verification. An authentication bypass vulnerability exists in the WordPress OwnID Passwordless Login plugin,...

131 Chrome Extensions Caught Hijacking WhatsApp Web for Massive Spam Campaign

Cybersecurity researchers have uncovered a coordinated campaign that leveraged 131 rebranded clones of a WhatsApp Web automation extension for Google Chrome to spam Brazilian users at scale. The 131 spamware extensions share the same codebase, design patterns, and infrastructure, according to...

Malicious Package

Overview @global-engineering-shared/gweb-material-global is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

JLSEC-2025-165 An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1

An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-based client subscribes to signals from a trusted system service such as NetworkManager on a shared computer, other users of the same computer can send spoofed D-Bus signals that the GDBus-based...

EUVD-2025-34876

Malicious code in cp2-shared-components npm...

Malicious code in cp2-shared-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e522530df817242e07e68b2cb283eb4e70763b4ba8d248c97791fab28dc67887 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48450 Malicious code in cp2-shared-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e522530df817242e07e68b2cb283eb4e70763b4ba8d248c97791fab28dc67887 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-10294

The OwnID Passwordless Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.3.4. This is due to the plugin not properly checking if the ownidsharedsecret value is empty prior to authenticating a user via JWT. This makes it possible for...

Clam AntiVirus Toolkit 1.5.1

Clam AntiVirus is an anti-virus toolkit for Unix. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command-line scanner, and a tool for automatic updating via Internet. The programs ar...

fortinet FortiAnalyzer Competitive Conditions Issue Vulnerability

FortiAnalyzer is Fortinet's centralized security log management and analysis platform. FortiAnalyzer suffers from a competitive condition vulnerability that stems from an improper synchronization mechanism for shared resources. An attacker can exploit this vulnerability to bypass the FortiCloud...

Prototype Pollution

Overview happy-dom is a Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. It includes many web standards from WHATWG DOM and HTML. Affected versions of this package are vulnerable to Prototype Pollution via the shared process between untrusted scripts...

Prototype Pollution

Overview org.webjars.npm:happy-dom is a Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. It includes many web standards from WHATWG DOM and HTML. Affected versions of this package are vulnerable to Prototype Pollution via the shared process between...

CVE-2025-59282

Concurrent execution using shared resource with improper synchronization 'race condition' in Inbox COM Objects allows an unauthorized attacker to execute code locally...

CVE-2025-59195

Concurrent execution using shared resource with improper synchronization 'race condition' in Microsoft Graphics Component allows an authorized attacker to deny service locally...

CVE-2025-42939

SAP S/4HANA Manage Processing Rules - For Bank Statements allows an authenticated attacker with basic privileges to delete conditions from any shared rule of any user by tampering the request parameter. Due to missing authorization check, the attacker can delete shared rule conditions that should...