MAL-2025-6237 Malicious code in gafana-test-utils (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a4e648e988f33de6b085bf631d45494adb7b9be241071b454c40705384ad7e6e The OpenSSF Package Analysis project identified 'gafana-test-utils' @...

BELL-CVE-2025-54566

Bulletin has no description...

BELL-CVE-2025-54567

Bulletin has no description...

CVE-2025-54566

hw/pci/pciesriov.c in QEMU through 10.0.3 has a migration state inconsistency, a related issue to CVE-2024-26327...

PT-2025-30900 · Unknown · Tawk.To Live Chat

Name of the Vulnerable Software and Affected Versions: tawk.to Live Chat version 1.6.1 Description: A Cross Site Scripting issue exists in tawk.to Live Chat. The web application stores and displays user-supplied input without proper input validation or encoding, potentially allowing a remote...

PT-2025-30888 · Gardyn · Gardyn

Name of the Vulnerable Software and Affected Versions: Gardyn version 4 Description: An issue in Gardyn 4 allows a remote attacker to obtain sensitive information and execute arbitrary code via a request. Recommendations: At the moment, there is no information about a newer version that contains ...

Calibre Web and Autocaliweb have OS Command Injection vulnerability

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Calibre Web, Autocaliweb allows Blind OS Command Injection. This issue affects Calibre Web: 0.6.24 Nicolette; Autocaliweb: from 0.7.0 before 0.7.1...

GHSA-QC4J-V7H6-XR5H Calibre Web and Autocaliweb have OS Command Injection vulnerability

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Calibre Web, Autocaliweb allows Blind OS Command Injection. This issue affects Calibre Web: 0.6.24 Nicolette; Autocaliweb: from 0.7.0 before 0.7.1...

WordPress WooCommerce Point Of Sale (POS) <= 1.4 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by Nguyen Kim Sang in WordPress Plugin WooCommerce Point Of Sale POS versions = 1.4...

Improper Input Validation

org.apache.jena, jena is vulnerable to Improper Input Validation. The vulnerability is due to lack of validation on file access paths in configuration files uploaded by administrators, which allows an attacker to upload arbitrary configurations and potentially manipulate system behavior...

BELL-CVE-2025-54090

Bulletin has no description...

Improper Input Validation

@haxtheweb/haxcms-nodejs is vulnerable to improper input validation. The vulnerability is due to the application not properly handling exceptions when required URL parameters are missing in authenticated API requests, which allows an attacker to crash the application via the listFiles and saveFil...

PT-2025-30699

Name of the Vulnerable Software and Affected Versions Calibre Web versions 0.6.24 Autocaliweb versions 0.7.0 through 0.7.0 Description Calibre Web and Autocaliweb are susceptible to a blind OS command injection issue due to improper neutralization of special elements used in OS commands. This...

The vulnerability of the UMIP function in AMD’s microprogramming software allows attackers to disclose protected information.

The vulnerability of the UMIP function in AMD’s microprogramming software is related to insufficient protection of operational data. Exploiting this vulnerability can allow attackers to disclose protected information...

The vulnerability of the fromSafeClientFilter() function in the file /goform/SafeClientFilter of the Tenda FH451 router’s microprogramming system allows a attacker to execute arbitrary code or cause a service failure.

The vulnerability of the fromSafeClientFilter function in the /goform/SafeClientFilter module of the Tenda FH451 router’s software is related to buffer overflows based on a stack-based mechanism when processing the Go parameter. Exploiting this vulnerability allows an attacker to execute arbitrar...

PT-2025-30628 · Medtronic · Mycarelink Patient Monitor 24952 +1

Name of the Vulnerable Software and Affected Versions: Medtronic MyCareLink Patient Monitor models 24950 and 24952 before June 25, 2025 Description: The Medtronic MyCareLink Patient Monitor contains an internal service that deserializes data. A local attacker can interact with this service by...

PT-2025-30667 · Unknown · Moderec Tourtella

Name of the Vulnerable Software and Affected Versions: Moderec Tourtella versions prior to 26.05.2025 Description: A SQL Injection issue exists in Moderec Tourtella due to improper neutralization of special elements used in an SQL command. This allows for the execution of malicious commands...

MAL-2025-6301 Malicious code in plide (npm)

The package communicates with a domain associated with malicious activity...

CVE-2025-53942 authentik has an insufficient check for account active status during OAuth/SAML authentication

authentik is an open-source Identity Provider that emphasizes flexibility and versatility, with support for a wide set of protocols. In versions 2025.4.4 and earlier, as well as versions 2025.6.0-rc1 through 2025.6.3, deactivated users who registered through OAuth/SAML or linked their accounts to...

Remote File Inclusion

librenms/librenms is vulnerable to Remote File Inclusion RFI. The vulnerability is due to unsafe dynamic file inclusion caused by the ajaxform.php endpoint using user-controlled POST input in the type parameter to include .inc.php files without proper validation or allowlisting, potentially leadi...