Malicious code in frontegg-nuxt-example (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1dfeb24eb6c59e883dded7166ce9ff73fb43ab8352fcc2a154f86c7bf96be5e8 Any computer that has this package installed or running should be considered...

CVE-2025-48125

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in WP Event Manager WP Event Manager wp-event-manager allows PHP Local File Inclusion.This issue affects WP Event Manager: from n/a through = 3.1.51...

CVE-2025-31635

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in LambertGroup CLEVER lbg-audio11-html5-shoutcasthistory allows Path Traversal.This issue affects CLEVER: from n/a through = 2.6...

MAL-2025-4724 Malicious code in next-pwa-template (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 598361c7d39c208feedabd0f7d7e0b666d50ad75fa8f2c7db2a64654e3c6a194 Any computer that has this package installed or running should be considered...

MINI-W3J4-8RR9-XMP3

Bulletin has no description...

MAL-2025-4723 Malicious code in 0x000asdqwe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9ea8c61fc9f49cdc0f6a22b805c76011ff8bd9143b77d223068fdb6f7d0d342e The OpenSSF Package Analysis project identified '0x000asdqwe' @ 5.0.0 npm as malicious. It is considered malicious because: - The package...

MINI-CR3F-F644-XMQR

Bulletin has no description...

Authorization Bypass

github.com/authzed/spicedb is vulnerable to Authorization Bypass. The vulnerability is due to improper handling of caveated branches during permission checks in schemas with caveats on arrow’ed relations, allowing an attacker to deny legitimate access and disrupt authorized operations for valid...

PT-2025-24420 · Zoho · Network Configuration Manager +4

Name of the Vulnerable Software and Affected Versions: Zohocorp ManageEngine OpManager, NetFlow Analyzer, Network Configuration Manager, Firewall Analyzer, and OpUtils versions 128565 and below Description: The issue concerns a Reflected XSS vulnerability on the login page. Recommendations: For...

libxslt security update

1.1.32-6.2.0.1 - Added libxslt-oracle-enterprise.patch and replaced doc/redhat.gif in tarball 1.1.32-6.2 - Fix CVE-2023-40403 aka 2022-4909 RHEL-89374...

PT-2025-24435 · Github +4 · Github +4

Name of the Vulnerable Software and Affected Versions: Wasp versions prior to 0.16.6 Description: The issue concerns the implementation of OAuth authentication in Wasp, specifically affecting Keycloak with a particular configuration. Wasp's behavior of lowercasing OAuth user IDs before storing or...

ALSA-2025:8635 Important: perl-FCGI security update

FastCGI Perl bindings. Security Fixes: perl-fcgi: FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 aka fcgi library CVE-2025-40907 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related...

MAL-2025-6451 Malicious code in atlasctf-21-prod-14 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 53e97c9ccd81536ef4d3b1aacb14600cc31b01f8bf00b53326458e485459c7e4 On installation or importing, the package attempts to exfiltrate some basic information, e.g. /etc/passwd --- Category: PROBABLYPENTEST - Packages looking like...

MAL-2025-6448 Malicious code in atlasctf-21-prod-11 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ece7411f662f1c3b05a8f6bbda7c94099f1e20acc383cefb69bc8195da83e86a On installation or importing, the package attempts to exfiltrate some basic information, e.g. /etc/passwd --- Category: PROBABLYPENTEST - Packages looking like...

BELL-CVE-2025-38001

Bulletin has no description...

CVE-2025-49619

Skyvern through 0.1.85 is vulnerable to server-side template injection SSTI in the Prompt field of workflow blocks such as the Navigation v2 Block. Improper sanitization of Jinja2 template input allows authenticated users to inject crafted expressions that are evaluated on the server, leading to...

CGA-3QPV-V6GF-PX9X

Bulletin has no description...

CVE-2025-49306

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in catchsquare WP Social Widget wp-social-widget allows Stored XSS.This issue affects WP Social Widget: from n/a through = 2.3...

CVE-2025-49273

Cross-Site Request Forgery CSRF vulnerability in sminozzi WP Tools wptools allows Cross Site Request Forgery.This issue affects WP Tools: from n/a through = 5.24...

CVE-2025-41362 Code injection vulnerability in IDF and ZLF

Code injection vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that...