PT-2025-8665

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description An issue exists where an attacker can pass a malicious malformed token, causing unexpected memory consumption during parsing. Recommendations At the moment, there is no information about a new...

CVE-2025-25208

No description is available for this CVE...

CVE-2025-26531

Insufficient capability checks made it possible to disable badges a user does not have permission to access...

CVE-2025-26533

An SQL injection risk was identified in the module list filter within course search...

CVE-2025-26530

The question bank filter required additional sanitizing to prevent a reflected XSS risk...

Moodle allows reflected XSS via question bank filter

The question bank filter required additional sanitizing to prevent a reflected XSS risk...

CVE-2025-1594

A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ffaacsearchfortns of the file libavcodec/aacenctns.c of the component AAC Encoder. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The...

Phusion Passenger denial of service

The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP method...

CVE-2025-1632

A flaw was found in the bsdunzip utility of libarchive. In affected versions, a specially crafted file may trigger a null pointer dereference. This issue can lead to an application crash or other unexpected behavior...

Advisory ROSA-SA-2025-2716

Software: perl 5.26.3 OS: ROSA Virtualization 3.0 packageevrstring: perl-5.26.3 CVE-ID: CVE-2020-10878 BDU-ID: 2020-04040 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the PLregkindOPn == NOTHING parameter of the Perl programming language interpreter is related to integer overflow. Exploitation of...

Mattermost allows reading arbitrary files

Mattermost versions 10.4.x = 10.4.1, 9.11.x = 9.11.7, 10.3.x = 10.3.2, 10.2.x = 10.2.2 fail to properly validate input when patching and duplicating a board, which allows a user to read any arbitrary file on the system via duplicating a specially crafted block in Boards...

CVE-2025-25460

A stored Cross-Site Scripting XSS vulnerability was identified in FlatPress 1.3.1 within the "Add Entry" feature. This vulnerability allows authenticated attackers to inject malicious JavaScript payloads into blog posts, which are executed when other users view the posts. The issue arises due to...

Phusion Passenger denial of service

The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP method...

CVE-2025-27106

binance-trading-bot is an automated Binance trading bot with trailing buy/sell strategy. Authenticated users of binance-trading-bot can achieve Remote Code Execution on the host system due to a command injection vulnerability in the /restore endpoint. The restore endpoint of binance-trading-bot i...

MAL-2025-1519 Malicious code in erc20-faucet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b1318f067a3c4a722bc3d70af3c94d47696dc695c07dafc5cac772db0e1b20fd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-13585

The Ajax Search Lite WordPress plugin before 4.12.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

MAL-2025-1546 Malicious code in tstfde54545 (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain...

MAL-2025-1536 Malicious code in archon4 (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ec2543510c509cdbd699b1c37ba00b56f4d5004085b9e485f6541b23a6e18c2 Any computer that has this package install...

MAL-2025-1537 Malicious code in archon6 (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9926eff92492428efb3018691093b936b8924920a886240875a09cec72235ead Any computer that has this package install...

MAL-2025-1532 Malicious code in int_pinterest_sfra (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5df2e57eea52ed8dde5d43556a1ba3cf1936fcf242455da6ded7ae795ce25a5c Any computer that has this package install...