CVE-2024-0146

CVE-2024-0146 affects NVIDIA vGPU software’s Virtual GPU Manager. The vulnerability is described as memory corruption in the Virtual GPU Manager that could allow a malicious guest to cause code execution, denial of service, information disclosure, or data tampering. The CVSS 3.1 vectors (Local at...

CVE-2025-22865

Using ParsePKCS1PrivateKey to parse a RSA key that is missing the CRT values would panic when verifying that the key is well formed...

OSV-2025-68 UNKNOWN READ in std::__1::__function::__func<cv::PngDecoder::compose_frame

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=392318892 Crash type: UNKNOWN READ Crash state: std::1::function::funccv::PngDecoder::composeframe cv::ParallelLoopBodyWrapper::operator cv::ThreadPool::run...

Dolibarr Cross-site Scripting vulnerability

A cross-site scripting XSS vulnerability in the Product module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload injected into the Title parameter...

CVE-2025-22604 Cacti has Authenticated RCE via multi-line SNMP responses

Cacti is an open source performance and fault management framework. Due to a flaw in multi-line SNMP result parser, authenticated users can inject malformed OIDs in the response. When processed by ssnetsnmpdiskio or ssnetsnmpdiskbytes, a part of each OID will be used as a key in an array that is...

CVE-2023-47159 IBM Sterling File Gateway information disclosure

IBM Sterling File Gateway 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.1 could allow an authenticated user to enumerate usernames due to an observable discrepancy in request responses...

A week in security (January 20 &#8211; January 26)

Last week on Malwarebytes Labs: Your location or browsing habits could lead to price increases when buying online AI tool GeoSpy analyzes images and identifies locations in seconds 7-Zip bug could allow a bypass of a Windows security feature. Update now Warning: Don’t sell or buy a second hand...

BIT-RUBY-MIN-2020-25613

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy which also has a po...

BIT-RUBY-MIN-2021-28966

In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir...

Remote Code Execution (RCE)

system.linq.dynamic.core is vulnerable to Remote code execution RCE. The vulnerability is due to insufficient input validation and improper access control when handling reflection types and static properties/fields in the System.Linq.Dynamic.Core library, allows remote access without proper...

OSV-2025-63 Stack-buffer-underflow in gs_type1_interpret

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=391934080 Crash type: Stack-buffer-underflow READ 4 Crash state: gstype1interpret copiedtype1glyphoutline gsdefaultglyphinfo...

PT-2025-1948 · WordPress · Altra Side Menu

Name of the Vulnerable Software and Affected Versions: Altra Side Menu WordPress plugin versions 2.0 and earlier Description: The issue allows admins to perform SQL injection attacks due to a parameter not being sanitized and escaped before use in a SQL statement. Recommendations: Altra Side Menu...

The vulnerability of SimpleHelp’s software for remote support lies in the insecure management of privileges, allowing a perpetrator to escalate their privileges.

The vulnerability of SimpleHelp’s software for remote support is related to insecure management of privileges. Exploiting this vulnerability allows a malicious actor to elevate their privileges to the root level...

PT-2025-1299

Name of the Vulnerable Software and Affected Versions Cacti versions prior to 1.2.29 Cacti versions prior to 1.2.24+ds1-1+deb12u5 Cacti versions prior to 1.2.16+ds1-2+deb11u5 Description Cacti, a web interface for graphing of monitoring systems, contains a flaw in its multi-line SNMP result parse...

NodeBB Cross-site scripting (XSS) vulnerability

A persistent cross-site scripting XSS vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' section of their profile...

GHSA-VQR3-VRRG-F3JH NodeBB Cross-site scripting (XSS) vulnerability

A persistent cross-site scripting XSS vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' section of their profile...

CVE-2025-24719

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpdevart Widget Countdown widget-countdown allows Stored XSS.This issue affects Widget Countdown: from n/a through = 2.7.1...

CVE-2025-24746 WordPress Popup Maker plugin <= 1.20.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Daniel Iser Popup Maker popup-maker allows Stored XSS.This issue affects Popup Maker: from n/a through = 1.20.2...

CVE-2025-23838

CVE-2025-23838 is a Reflected XSS in the WordPress Bauernregeln plugin NotFound, affecting versions n/a–1.0.1 (per sources from NVD/Red Hat) and publicly documented as a WordPress plugin vulnerability. The linked Red Hat/NVD entries confirm the same description and affected range. The PTSecurity ...

MAL-2025-568 Malicious code in com.unity.test.metadata-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 703b2d3b91d7b6130d1e2d95312b0f80ca094abe683340c79b3b3ca0dbc84423 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...