CVE-2025-54379 eKuiper API endpoints handling SQL queries with user-controlled table names.

LF Edge eKuiper is a lightweight IoT data analytics and stream processing engine running on resource-constraint edge devices. In versions before 2.2.1, there is a critical SQL Injection vulnerability in the getLast API functionality of the eKuiper project. This flaw allows unauthenticated remote...

CVE-2025-7404 Calibre Web 0.6.24 & Autocaliweb 0.7.0 - Blind C

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Calibre Web, Autocaliweb allows Blind OS Command Injection.This issue affects Calibre Web: 0.6.24 Nicolette; Autocaliweb: from 0.7.0 before 0.7.1...

CGA-Q428-HVH3-33QW

Bulletin has no description...

MAL-2025-6226 Malicious code in react-dom-builtin (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ac7450c93d4fe9acd7455d948757158cfef0776508f78ee3544d4cad40dc18b2 The OpenSSF Package Analysis project identified 'react-dom-builtin' @...

CGA-QG9F-JW8X-WV4H

Bulletin has no description...

MAL-2025-6322 Malicious code in vercel-internal (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-6278 Malicious code in binance-internals (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-6306 Malicious code in retirejs (npm)

The package communicates with a domain associated with malicious activity...

CGA-HC2M-XW7C-3WR5

Bulletin has no description...

CGA-MP9R-PQ3P-Q3QC

Bulletin has no description...

MAL-2025-6317 Malicious code in testandooteste (npm)

The package communicates with a domain associated with malicious activity...

PT-2025-30664

Name of the Vulnerable Software and Affected Versions Bayraktar Solar Energies ScadaWatt Otopilot versions prior to 27.05.2025 Description A SQL Injection issue exists in Bayraktar Solar Energies ScadaWatt Otopilot. The vulnerability is due to improper neutralization of special elements used in a...

CGA-9M6X-QCRX-9XFJ

Bulletin has no description...

CVE-2025-54377 Roo Code Lacks Line Break Validation in its Command Execution Tool

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions 3.23.18 and below, RooCode does not validate line breaks \n in its command input, allowing potential bypass of the allow-list mechanism. The project appears to lack parsing or validation logic to prevent...

CGA-X38X-69C3-6J9R

Bulletin has no description...

CGA-3RWG-FQJ7-R7CF

Bulletin has no description...

Security Bulletin: IBM® Db2® is vulnerable to a denial of service under specific conditions (CVE-2024-52903)

Summary IBM® Db2® is vulnerable to a denial of service under specific conditions with a specially crafted query. Vulnerability Details CVEID:CVE-2024-52903 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server is vulnerable to a denial of service as the server may crash und...

MAL-2025-6276 Malicious code in askama (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-6315 Malicious code in teamstelemetry (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7838b0f51882af6cd99758551eec942e5c2abcd214ebe7c1e8b3c59dbece4224 The OpenSSF Package Analysis project identified 'teamstelemetry' @...

WordPress Video Blogster Lite plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Video Blogster Lite versions = 1.2...