13073 matches found
MINI-GXX6-WQR3-9HV4
Bulletin has no description...
MINI-2CXJ-C57Q-397W
Bulletin has no description...
MAL-2025-6739 Malicious code in node-calculator-fahw (npm)
The package communicates with a domain associated with malicious activity...
CVE-2025-52131
The Mocca Calendar application before 2.15 for XWiki allows XSS via the background or text color field...
MAL-2025-6692 Malicious code in aiohappyeyeballs (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2059da56cd060292843a9bf0b02a2c41b90d84e83b5b15aa59580a8bc9084a23 The OpenSSF Package Analysis project identified 'aiohappyeyeballs' @...
MAL-2025-6679 Malicious code in xo-angular-ui-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 17c1ba74b83fb3a51e171948d55aa626342a1477d24f1f0f768f093cba5feef7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CGA-FVH6-H8CG-6G9F
Bulletin has no description...
MINI-GVQM-H5M6-8WP2
Bulletin has no description...
MINI-4H2R-8VQR-96QF
Bulletin has no description...
CVE-2025-6076
Partner Software's Partner Software application and Partner Web application do not sanitize files uploaded on the "reports" tab, allowing an authenticated attacker to upload a malicious file and compromise the device. By default, the software runs as SYSTEM, heightening the severity of the...
OSV-2025-591 UNKNOWN READ in mov_read_header
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=435536867 Crash type: UNKNOWN READ Crash state: movreadheader avformatopeninput demuxopenlavf...
CGA-37JM-96VQ-HP7G
Bulletin has no description...
GHSA-6H4P-M86H-HHGH Hashicorp Vault has Privilege Escalation Vulnerability
A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s token privileges to Vault’s root policy. Fixed in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11 and 1.16.22...
MAL-2025-6732 Malicious code in internal-random (npm)
The package communicates with a domain associated with malicious activity...
CVE-2025-54593 FreshRSS is vulnerable to RCE attacks by authenticated admin
FreshRSS is a free, self-hostable RSS aggregator. In versions 1.26.1 and below, an authenticated administrator user can execute arbitrary code on the FreshRSS server by modifying the update URL to one they control, and gain code execution after running an update. After successfully executing code...
CVE-2025-53011 MaterialX is Vulnerable to NULL Pointer Dereference due to Unchecked implGraphOutput
MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In version 1.39.2, when parsing shader nodes in a MTLX file, the MaterialXCore code accesses a potentially null pointer, which can lead to crashes with maliciously craft...
CVE-2025-45767
jose v6.0.10 was discovered to contain weak encryption. NOTE: this is disputed by a third party because the claim of "do not meet recommended security standards" does not reflect guidance in a final publication...
MINI-MWF4-QFWX-7GH4
Bulletin has no description...
CVE-2025-8454
It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts a collection of scripts to make the life of a Debian Package maintainer easier, skips OpenPGP verification if the upstream source is already downloaded from a previous run even...