13073 matches found
Code Injection
github.com/cosmos/evm are vulnerable to Code Injection. The vulnerability is due to setting lower EVM call gas limits, which allows the precompile code to partially execute and then fail without reverting the already made state changes...
MAL-2025-3861 Malicious code in @okdev/boiler_plate (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 03430707bf9707317455858dacbbd05a07b53ddf958d87ce767b27067864b864 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
PT-2025-21733 · Estatik · Estatik Mortgage Calculator
Name of the Vulnerable Software and Affected Versions: Mortgage Calculator Estatik versions n/a through 2.0.12 Description: The issue is related to improper control of filename for include/require statement in PHP program, also known as 'PHP Remote File Inclusion'. This allows PHP Local File...
CVE-2025-48175
In libavif before 1.3.0, avifImageRGBToYUV in reformat.c has integer overflows in multiplications involving rgbRowBytes, yRowBytes, uRowBytes, and vRowBytes...
CVE-2025-47930 Zulip Server has access control bypass for restrictions on creation of specific channel types
Zulip is an open-source team chat application. Starting in version 10.0 and prior to version 10.3, the "Who can create public channels" access control mechanism can be circumvented by creating a private or web-public channel, and then changing the channel privacy to public. A similar technique...
MAL-2025-5119 Malicious code in myownpyfiglet (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 feb59db3efc9397070b6fcdf08762e0defb77d34e5ababf463e3c1a7a1f5b927 Malicious clone of pyfiglet. Importing the package starts a series of downloading and executing of obfuscated malicious scripts, partially identified by AVs. -...
GO-2025-3689 Ollama Divide by Zero Vulnerability in github.com/ollama/ollama
Ollama Divide by Zero Vulnerability in github.com/ollama/ollama...
CVE-2025-47786 Emlog vulnerable to Stored Cross-site Scripting
Emlog is an open source website building system. Version 2.5.13 has a stored cross-site scripting vulnerability that allows any registered user to construct malicious JavaScript, inducing all website users to click. In /admin/comment.php, the parameter perpagenum is not validated and is directly...
CVE-2025-47787 Emlog Pro Contains a File Upload Vulnerability
Emlog is an open source website building system. Emlog Pro prior to version 2.5.10 contains a file upload vulnerability. The store.php component contains a critical security flaw where it fails to properly validate the contents of remotely downloaded ZIP plugin files. This insufficient validation...
GHSA-FPFF-WJ6M-GRVR Mattermost Fails to Check User Access to `ExperimentalSettings`
Mattermost versions 10.5.x = 10.5.2, 9.11.x = 9.11.11 fail to check RestrictSystemAdmin setting if user doesn't have access to ExperimentalSettings which allows a System Manager to access ExperimentSettings when RestrictSystemAdmin is true via System Console...
CGA-HJ9P-RHP3-HF4P
Bulletin has no description...
GHSA-R7R2-M3VR-C8QC Mattermost Fails to Validate Team Invite Permissions
Mattermost versions 10.6.x = 10.6.1, 10.5.x = 10.5.2, 10.4.x = 10.4.4, 9.11.x = 9.11.11 fail to check the correct permissions which allows authenticated users who only have permission to invite non-guest users to a team to add guest users to that team via the API to add a single user to a team...
BELL-CVE-2025-20623
Bulletin has no description...
BELL-CVE-2024-43420
Bulletin has no description...
MAL-2025-3856 Malicious code in spl-tokens (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 86e0efcb779c43be336174a24f04614ab82be9f92a235feaf6e344d814bb2789 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-3948 Malicious code in developer-bridge (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 13d76633d0e28457718da249adad23171e53973864ef3e53406c78ced005d3af The OpenSSF Package Analysis project identified 'developer-bridge' @ 2.0.0 npm as malicious. It is considered malicious because: - The package...
Jenkins Health Advisor by CloudBees Plugin Vulnerable to Cross-Site Scripting
Jenkins Health Advisor by CloudBees Plugin 374.v194bd4f0c8c8 and earlier does not escape responses from the Jenkins Health Advisor server, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to control Jenkins Health Advisor server responses...
Jenkins DingTalk Plugin Unconditionally Disables SSL/TLS Certificate and Hostname Validation
Jenkins DingTalk Plugin 2.7.3 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections to the configured DingTalk webhooks...
K000151329: MySQL vulnerabilities CVE-2025-30704, CVE-2025-30705, and CVE-2025-30706
Security Advisory Description CVE-2025-30704 Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Components Services. Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Difficult to exploit vulnerability allows high privileged attacker wit...