MAL-2025-1470 Malicious code in mygcpconfusedfunctionpocmaliciouspackage (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 716d3d7344ecf41184b8427f14e96e4bee1a868051bae909e0f3da2fcea408ab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-45783

A flaw was found in grub2. When failing to mount an HFS+ grub, the hfsplus filesystem driver doesn't properly set an ERRNO value. This issue may lead to a NULL pointer access. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat...

CVE-2024-13797

The PressMart - Modern Elementor WooCommerce WordPress Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.16. This is due to the software allowing users to execute an action that does not properly validate a value before running...

BELL-CVE-2025-1377

Bulletin has no description...

BELL-CVE-2025-1352

Bulletin has no description...

BELL-CVE-2025-1365

Bulletin has no description...

CVE-2024-13522 magayo Lottery Results <= 2.0.12 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The magayo Lottery Results plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.12. This is due to missing or incorrect nonce validation on the 'magayo-lottery-results' page. This makes it possible for unauthenticated attackers to update...

CVE-2024-57971

DataSourceResource.java in the SpagoBI API support in Knowage Server in KNOWAGE before 8.1.30 does not ensure that java:comp/env/jdbc/ occurs at the beginning of a JNDI Name...

PT-2025-7202 · Vim +5 · Vim +5

Name of the Vulnerable Software and Affected Versions: Vim versions prior to 9.1.1115 Description: The issue arises when redirecting the output of the :display command to a register that is being displayed, leading to a use-after-free. This occurs because Vim frees the register content before...

CVE-2025-25468

FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/mem.c...

CVE-2025-25471

FFmpeg git master before commit fd1772 was discovered to contain a NULL pointer dereference via the component libavformat/mov.c...

CVE-2025-25469

FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/iamf.c...

CVE-2025-22921

FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c...

CVE-2025-25473

FFmpeg git master before commit c08d30 was discovered to contain a memory leak in the avformatfreecontext function in libavutil/mem.c...

PT-2025-6821 · Churchcrm · Churchcrm

Name of the Vulnerable Software and Affected Versions: ChurchCRM versions 5.13.0 and prior Description: A time-based blind SQL Injection vulnerability exists in the EditEventTypes functionality, allowing an attacker to execute arbitrary SQL queries. The newCountName parameter is directly...

BIT-GITLAB-2025-1198 Insufficient Session Expiration in GitLab

An issue discovered in GitLab CE/EE affecting all versions from 16.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 meant that long-lived connections in ActionCable potentially allowed revoked Personal Access Tokens access to streaming results...

Denial Of Service (DoS)

parse-duration is vulnerable to Denial Of Service DoS. The vulnerability is due to CPU-bound operations that resolve a provided string, causing delays of 0.5ms to 50ms per operation and crashes due to memory exhaustion when the string size reaches approximately 10 MB with Unicode characters, allo...

CVE-2025-1378

A flaw was found in radare2 rasm2. This vulnerability allows memory corruption via local access and manipulation of the /libr/main/rasm2.c library...

MAL-2025-1422 Malicious code in kcex-main (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 250e2784873b2d4ccedb1c0017d13580afe0f3a3c3d956afeedcc1b962cc197d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-0995

Use after free in V8 in Google Chrome prior to 133.0.6943.98 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High Mitigation Mitigation for this issue is either not available or the currently available options do not meet the R...