CVE-2025-24371 Malicious peer can make node stuck in blocksync in github.com/cometbft/cometbft

CometBFT is a distributed, Byzantine fault-tolerant, deterministic state machine replication engine. In the blocksync protocol peers send their base and latest heights when they connect to a new node A, which is syncing to the tip of a network. base acts as a lower ground and informs A that the...

CVE-2025-25064

SQL injection vulnerability in the ZimbraSync Service SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10.1.x before 10.1.4 due to insufficient sanitization of a user-supplied parameter. Authenticated attackers can exploit this vulnerability by manipulating a specific parameter in...

Malicious code in apple-sync (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0c8a2862682c8b22d925c82e7abc361ea6cb147190926513d7f7c09af233899 Any computer that has this package installed or running should be considered...

MAL-2025-1014 Malicious code in apple-sync (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0c8a2862682c8b22d925c82e7abc361ea6cb147190926513d7f7c09af233899 Any computer that has this package installed or running should be considered...

CometBFT allows a malicious peer to make node stuck in blocksync

Name: ASA-2025-001: Malicious peer can disrupt node's ability to sync via blocksync Component: CometBFT OUTDATED Criticality: Medium Considerable Impact; Possible Likelihood per ACMv1.2 Update of Criticality on 2026-03-06: We've made a mistake and over-rated the criticality of this bug in our...

PT-2025-20511

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A issue in the Linux kernel has been identified where the task management thread accesses an invalid queue ID, set by the reset thread, which points to unallocated memory, causing a cras...

WordPress Woocommerce osCommerce Sync plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Woocommerce osCommerce Sync versions = 2.0.20...

CVE-2025-23216

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. The vulnerability assumes the user has write...

CVE-2025-23216: Generation of Error Message Containing Sensitive Information

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. The vulnerability assumes the user has write...

Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync

...

com.alibaba.alink:alink_connectors_hive_flink-1.10_2.11 (>=1.1.2, <=1.2.0), com.alibaba.alink:alink_connectors_hive_flink-1.11_2.11 (1.2.0) +26 more potentially affected by CVE-2024-29869 via org.apache.hive:hive-exec (2.3.4)

org.apache.hive:hive-exec MAVEN version 2.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - com.alibaba.alink:alinkconnectorshiveflink-1.102.11 =1.1.2, =1.1.2, =1.3.0, =1.3.0, =1.3.1, =1.4.0,...

Malicious code in meli-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 793bfcfb95a79b8cd268833db69c5dc0bc95766ce7acef8947614e19d8e27afc The OpenSSF Package Analysis project identified 'meli-sync' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-564 Malicious code in meli-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 793bfcfb95a79b8cd268833db69c5dc0bc95766ce7acef8947614e19d8e27afc The OpenSSF Package Analysis project identified 'meli-sync' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in lyft-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bad08278af65d859072402dbc935300d4c8d6036f2f214644533c0af1b8f7b8e The OpenSSF Package Analysis project identified 'lyft-sync' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-539 Malicious code in lyft-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bad08278af65d859072402dbc935300d4c8d6036f2f214644533c0af1b8f7b8e The OpenSSF Package Analysis project identified 'lyft-sync' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in iberia-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3fa775f2b41624be8acd4b8b6be1dc827dc0012574f46c5baf62b0f4aeaa3440 The OpenSSF Package Analysis project identified 'iberia-sync' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-495 Malicious code in iberia-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3fa775f2b41624be8acd4b8b6be1dc827dc0012574f46c5baf62b0f4aeaa3440 The OpenSSF Package Analysis project identified 'iberia-sync' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in godaddy-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b27118be6531dda0274adb6114723c46d2c88efc9b6d648d2046baf78e396e9c The OpenSSF Package Analysis project identified 'godaddy-sync' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-472 Malicious code in godaddy-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b27118be6531dda0274adb6114723c46d2c88efc9b6d648d2046baf78e396e9c The OpenSSF Package Analysis project identified 'godaddy-sync' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in bookingcom-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6cc8ed36dec16e2f62b3d8b194b72fc8ae1702f19cd3f9bdb9ff1de3ab7d02b9 The OpenSSF Package Analysis project identified 'bookingcom-sync' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...