RHSA-2025:8669 Red Hat Security Advisory: kernel security update

Bulletin has no description...

RHSA-2025:8666 Red Hat Security Advisory: grafana security update

Bulletin has no description...

MAL-2025-4790 Malicious code in @react-native-aria/tabs (npm)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 9b37ef96f1f4f67e95f3c2e425a1e3ec62db2db5ef00217c25bf38990a69ec28 React Native ARIA and @gluestack-ui/utils had unauthorized new versions published that contained malicious code via a public access token...

BELL-CVE-2025-5914

Bulletin has no description...

MAL-2025-4809 Malicious code in @loybung/weather-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b8141e9c6d2ba6d7cf52aea200f4a596b4e7151c2c3a67b2713cd2cacc96038 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4804 Malicious code in @loybung/systeminfo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5779cbba538d4eea9269a796d61711d7b6cd149d33927746618c91c35bf31496 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4895 Malicious code in throttling-proxy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c9b4f801ac497e2e730cbe31fe53c685dfa14df13b8db1dbb454e614a321ac8d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Requests vulnerable to .netrc credentials leak via malicious URLs

Impact Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Workarounds For older versions of Requests, use of the .netrc file can be disabled with trustenv=False on your Requests Session docs. References...

Malicious code in frontegg-nuxt-example (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1dfeb24eb6c59e883dded7166ce9ff73fb43ab8352fcc2a154f86c7bf96be5e8 Any computer that has this package installed or running should be considered...

CVE-2025-48125

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in WP Event Manager WP Event Manager wp-event-manager allows PHP Local File Inclusion.This issue affects WP Event Manager: from n/a through = 3.1.51...

CVE-2025-31635

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in LambertGroup CLEVER lbg-audio11-html5-shoutcasthistory allows Path Traversal.This issue affects CLEVER: from n/a through = 2.6...

MAL-2025-4724 Malicious code in next-pwa-template (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 598361c7d39c208feedabd0f7d7e0b666d50ad75fa8f2c7db2a64654e3c6a194 Any computer that has this package installed or running should be considered...

MINI-W3J4-8RR9-XMP3

Bulletin has no description...

MAL-2025-4723 Malicious code in 0x000asdqwe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9ea8c61fc9f49cdc0f6a22b805c76011ff8bd9143b77d223068fdb6f7d0d342e The OpenSSF Package Analysis project identified '0x000asdqwe' @ 5.0.0 npm as malicious. It is considered malicious because: - The package...

MINI-CR3F-F644-XMQR

Bulletin has no description...

Authorization Bypass

github.com/authzed/spicedb is vulnerable to Authorization Bypass. The vulnerability is due to improper handling of caveated branches during permission checks in schemas with caveats on arrow’ed relations, allowing an attacker to deny legitimate access and disrupt authorized operations for valid...

libxslt security update

1.1.32-6.2.0.1 - Added libxslt-oracle-enterprise.patch and replaced doc/redhat.gif in tarball 1.1.32-6.2 - Fix CVE-2023-40403 aka 2022-4909 RHEL-89374...

ALSA-2025:8635 Important: perl-FCGI security update

FastCGI Perl bindings. Security Fixes: perl-fcgi: FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 aka fcgi library CVE-2025-40907 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related...

PT-2025-24435 · Github +4 · Github +4

Name of the Vulnerable Software and Affected Versions: Wasp versions prior to 0.16.6 Description: The issue concerns the implementation of OAuth authentication in Wasp, specifically affecting Keycloak with a particular configuration. Wasp's behavior of lowercasing OAuth user IDs before storing or...

PT-2025-24420 · Zoho · Network Configuration Manager +4

Name of the Vulnerable Software and Affected Versions: Zohocorp ManageEngine OpManager, NetFlow Analyzer, Network Configuration Manager, Firewall Analyzer, and OpUtils versions 128565 and below Description: The issue concerns a Reflected XSS vulnerability on the login page. Recommendations: For...