MAL-2025-4123 Malicious code in save-me-pls (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e53a2d57a5536d00cc75b7aa3e95b8f8d3373bc6da94392bbc578843872d648 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-37974 s390/pci: Fix missing check for zpci_create_device() error return

In the Linux kernel, the following vulnerability has been resolved: s390/pci: Fix missing check for zpcicreatedevice error return The zpcicreatedevice function returns an error pointer that needs to be checked before dereferencing it as a struct zpcidev pointer. Add the missing check in clpadd...

CVE-2025-37969 iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo

In the Linux kernel, the following vulnerability has been resolved: iio: imu: stlsm6dsx: fix possible lockup in stlsm6dsxreadtaggedfifo Prevent stlsm6dsxreadtaggedfifo from falling in an infinite loop in case patternlen is equal to zero and the device FIFO is not empty...

CVE-2025-37946 s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs

In the Linux kernel, the following vulnerability has been resolved: s390/pci: Fix duplicate pcidevput in disableslot when PF has child VFs With commit bcb5d6c76903 "s390/pci: introduce lock to synchronize state of zpcidev's" the code to ignore power off of a PF that has child VFs was changed from...

WordPress WPCHURCH plugin <= 2.7.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Phúc ton luoi in WordPress Plugin WPCHURCH versions = 2.7.0...

BELL-CVE-2025-4802

Bulletin has no description...

DLA-4173-1 openjdk-17 - security update

Bulletin has no description...

Adobe InDesign Null Pointer Dereference Vulnerability (CNVD-2025-15165)

Adobe InDesign is a set of layout and editing applications from the American company Audobee Adobe. A null pointer dereference vulnerability exists in Adobe InDesign version ID19.5.2 and ID20.2 and earlier versions, which can be exploited by an attacker to cause a denial of service...

WordPress Simplelightbox plugin <= 2.14.4 - Stored DOM-Based Cross-Site Scripting via SimpleLightbox JavaScript Library

Stored DOM-Based Cross-Site Scripting via SimpleLightbox JavaScript Library vulnerability discovered by Webbernaut in WordPress Plugin Simplelightbox versions = 2.14.4...

MAL-2025-4003 Malicious code in ing-it-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a401fddc840570943743504783ad66477db78abdaa07262ac9d0d55ec26823e3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-47757

V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds read in VS6MemInIF.dll!setplctypedefault function. Opening specially crafted V7 or V8 files may lead to crash, information disclosure, and arbitrary code execution...

MAL-2025-4032 Malicious code in valdatr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 68f4565e0cc0a62335e888be0acb41be1c47165a7d0a4e1482a34715864deea3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4024 Malicious code in social-network-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 89279e5bb7b18cd7f18b0018f976d1e055fbeb331245019a6c3e75796c3bf1e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-4905 iop-apl-uw basestation3 QC.py load_qc_pickl deserialization

A vulnerability was found in iop-apl-uw basestation3 up to 3.0.4 and classified as problematic. This issue affects the function loadqcpickl of the file basestation3/QC.py. The manipulation of the argument qcfile leads to deserialization. An attack has to be approached locally. The exploit has bee...

Ubuntu: Security Advisory (USN-7510-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-21975 · Unknown · Woocommerce

Name of the Vulnerable Software and Affected Versions: Product Code for WooCommerce versions 1.5.0 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows for Cross Site Request Forgery. This means an attacker can trick a user into performing unintended...

CVE-2024-55063

Multiple Code Injection vulnerabilities in EasyVirt DC NetScope = 8.7.0 allows remote authenticated attackers to execute arbitrary code via the 1 lang parameter to /international/keyboard/options; the 2 keyboardlayout or 3 keyboardvariant parameter to /international/settings/keyboard; the 4...

CGA-J53W-6WGV-HFW4

Bulletin has no description...

MAL-2025-3937 Malicious code in node-scoped-http-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 881ef5215aabb6e0d9dbaf7bbbdc6f804c031cb613c83b6fdb86f0efbc99d520 The OpenSSF Package Analysis project identified 'node-scoped-http-client' @ 2.0.0 npm as malicious. It is considered malicious because: - The...

MAL-2025-5105 Malicious code in coloramapkgsw (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d3b0703e237935a2a53d99b6e3ad717e1e604c218e5e21c97773615373adea16 Importing the module starts download and running a remote executable, identified as malware by AVs --- Category: MALICIOUS - The campaign has clearly malicious...