MAL-2025-38350 Malicious code in vida-menjes68-sukiwir (npm)

The package vida-menjes68-sukiwir was found to contain malicious code...

MAL-2025-9315 Malicious code in @sellerly-kit/tooltip (npm)

The package @sellerly-kit/tooltip was found to contain malicious code...

MAL-2025-34374 Malicious code in taekbae (npm)

The package taekbae was found to contain malicious code...

BIT-MOODLE-2024-43426 Moodle: arbitrary file read risk through pdftex

A flaw was found in pdfTeX. Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available, such as those with TeX Live installed...

CVE-2025-54802 pyLoad CNL Blueprint is vulnerable to Path Traversal through `dlc_path` leading to Remote Code Execution (RCE)

pyLoad is the free and open-source Download Manager written in pure Python. In versions 0.5.0b3.dev89 and below, there is an opportunity for path traversal in pyLoad-ng CNL Blueprint via package parameter, allowing Arbitrary File Write which leads to Remote Code Execution RCE. The addcrypted...

Malicious code in tms-spike (npm)

The package communicates with a domain associated with malicious activity...

Jenkins Applitools Eyes Plugin vulnerability does not mask API keys on its job configuration form

Jenkins Applitools Eyes Plugin 1.16.5 and earlier does not mask Applitools API keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them...

MAL-2025-5644 Malicious code in chia-dev-guides (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 346392e0fae6d3a254175cbf00c6b2ebbac781151d1eb9fe24079457e807b317 The OpenSSF Package Analysis project identified 'chia-dev-guides' @...

MAL-2025-5546 Malicious code in display-fetch_stream (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 93a196cb5e04250355d4a4e51d12810d2324320559124570c03be4209dba9d1f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cross-site Scripting

starcitizentools/citizen-skin is vulnerable to arbitrary HTML injection. The vulnerability is due to the system messages in menu headings being inserted as raw HTML without proper sanitization, allowing untrusted users with the editinterface permission to inject arbitrary HTML into the DOM...

01os (=0.0.14), ai-sec (>=0.0.1 <=0.0.9) +237 more potentially affected by CVE-2025-48945 via pycares (>=4.0.0 <=4.8.0)

pycares PYPI version =4.0.0, =0.0.1, =0.7.1, =0.1.0, =0.1.3, =2.0.4, =0.1.0, =0.1.3, =22.5.13, =1.0.1, =0.0.1, =3.4.2, =4.4.0 and more Source cves: CVE-2025-48945 Source advisory: SNYK:PYTHON-PYCARES-10365309...

CVE-2024-7077

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Semtek Informatics Software Consulting Inc. Semtek Sempos allows Reflected XSS. This issue affects Semtek Sempos: through 31072024...

MAL-2025-4094 Malicious code in lock-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0be45276ce7d117215945fe26ddbc98fb0cc53d60ecdaa71631175e44f8d4bb3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Lightgallery - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-069

This module integrates Drupal with LightGallery, enabling the use of the LightGallery library with any image field or view. The module does not adequately sanitize user input in the image field’s "alt" attribute, potentially allowing cross-site scripting XSS attacks when tags or scripts are...

BIT-MOODLE-2024-43440 Moodle: lfi vulnerability when restoring malformed block backups

A flaw was found in moodle. A local file may include risks when restoring block backups...

MAL-2025-3538 Malicious code in nsemea-sample-childtransaction-lib-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9f4b18779b0bb2c86773ae3990f1a744ca1d48e6edc3c9fdb2e54b24dd288cf5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-HXGG-4QWW-85PH Moodle has reflected Cross-site Scripting risk in policy tool

A flaw was found in Moodle. The return URL in the policy tool required additional sanitizing to prevent a reflected Cross-site scripting XSS risk...

CVE-2025-2903

An attacker with knowledge of creating user accounts during VM deployment on Google Cloud Platform GCP using the OS Login feature, can login via SSH gaining command-line control of the operating system. This allows an attacker to gain access to sensitive data stored on the VM, install malicious...

PT-2025-18667 · Totolink · Totolink Ca300-Poe

Name of the Vulnerable Software and Affected Versions: TOTOLINK CA300-POE version 6.2c.884 B20180522 Description: A command injection issue was discovered in the msg process function via the Url parameter. This issue allows attackers to execute arbitrary commands through a manipulated request...

BIT-DOLIBARR-2023-4197 Dolibarr ERP CRM (<= 18.0.1) Improper Input Sanitization Authenticated RCE

Improper input validation in Dolibarr ERP CRM = v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker to inject and evaluate arbitrary PHP code...