MAL-2025-5118 Malicious code in m5tlnyakblwa (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a3cc4be569e877aa213b4747e6285f9d2d46f68ee93d55ec9fddf7949c15ff94 Importing the module starts download and running a remote executable, identified as malware by AVs --- Category: MALICIOUS - The campaign has clearly malicious...

CGA-J2FR-6C3H-JJXH

Bulletin has no description...

CGA-2MM6-RQ4H-W39R

Bulletin has no description...

CGA-HGR5-MG3G-PRJQ

Bulletin has no description...

WordPress Ninja Tables Pro plugin <= 5.0.17 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Ninja Tables Pro versions = 5.0.17...

MAL-2025-5136 Malicious code in solana-coin (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 fa4c17031f4a667cddae42a648aa66edf30f498296c451a2c0637082772dbcef Code exfiltrates the current python code and/or IPythonshell history --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

CGA-28HM-R43X-HGXM

Bulletin has no description...

WordPress Broadstreet plugin <= 1.51.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by kmaron1n in WordPress Plugin Broadstreet Ads versions = 1.51.2...

MAL-2025-3915 Malicious code in rollup-plugin-remove-import (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 230bae792624cf6834a21e884402488ab15faca4797c79b7312463de4faf0593 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3878 Malicious code in com.meta.xr.sdk.avatars (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2819b05ade219214d57904bac7d545f37b68824e1a40e52668c7b6751d543c49 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3895 Malicious code in interaction-tracing (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware df3c2eb4540cdd7edb46dc3730a71a443bd1e3e63771f8046407a7f1d3c44e52 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

BELL-CVE-2025-23165

Bulletin has no description...

Code Injection

github.com/cosmos/evm are vulnerable to Code Injection. The vulnerability is due to setting lower EVM call gas limits, which allows the precompile code to partially execute and then fail without reverting the already made state changes...

MAL-2025-3861 Malicious code in @okdev/boiler_plate (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 03430707bf9707317455858dacbbd05a07b53ddf958d87ce767b27067864b864 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-48175

In libavif before 1.3.0, avifImageRGBToYUV in reformat.c has integer overflows in multiplications involving rgbRowBytes, yRowBytes, uRowBytes, and vRowBytes...

PT-2025-21733 · Estatik · Estatik Mortgage Calculator

Name of the Vulnerable Software and Affected Versions: Mortgage Calculator Estatik versions n/a through 2.0.12 Description: The issue is related to improper control of filename for include/require statement in PHP program, also known as 'PHP Remote File Inclusion'. This allows PHP Local File...

CVE-2025-47930 Zulip Server has access control bypass for restrictions on creation of specific channel types

Zulip is an open-source team chat application. Starting in version 10.0 and prior to version 10.3, the "Who can create public channels" access control mechanism can be circumvented by creating a private or web-public channel, and then changing the channel privacy to public. A similar technique...

MAL-2025-5119 Malicious code in myownpyfiglet (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 feb59db3efc9397070b6fcdf08762e0defb77d34e5ababf463e3c1a7a1f5b927 Malicious clone of pyfiglet. Importing the package starts a series of downloading and executing of obfuscated malicious scripts, partially identified by AVs. -...

GO-2025-3689 Ollama Divide by Zero Vulnerability in github.com/ollama/ollama

Ollama Divide by Zero Vulnerability in github.com/ollama/ollama...

CVE-2025-47786 Emlog vulnerable to Stored Cross-site Scripting

Emlog is an open source website building system. Version 2.5.13 has a stored cross-site scripting vulnerability that allows any registered user to construct malicious JavaScript, inducing all website users to click. In /admin/comment.php, the parameter perpagenum is not validated and is directly...