EUVD-2025-38223

Malicious code in rce-poc-test-honor-mcp npm...

Malicious Package

Overview rce-poc-test-honor-dev is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

EUVD-2025-38226

Malicious code in rce-poc-test-honor-dev npm...

Malware in chai-await-test

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-49380 Malicious code in chai-await-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ad46eab8b628ea50c737795204bf86f36069b9577310c833ea00a469024ec0b The package chai-await-test was found to contain malicious code. Source: ghsa-malware 47ca275095dc49120d03c89b6b2192f62339069acbd6717fc39d06c04c07037...

EUVD-2025-38231

Malicious code in chai-await-test npm...

Malicious code in chai-await-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ad46eab8b628ea50c737795204bf86f36069b9577310c833ea00a469024ec0b The package chai-await-test was found to contain malicious code. Source: ghsa-malware 47ca275095dc49120d03c89b6b2192f62339069acbd6717fc39d06c04c07037...

Malicious Package

Overview chai-await-test is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2025-64328 FreePBX Administration GUI is Vulnerable to Authenticated Command Injection

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and above before 17.0.3, the filestore module within the Administrative interface is vulnerable to a post-authentication command injection by an authenticated known user via the...

[SECURITY] Fedora 41 Update: python-starlette-0.42.0-3.fc41

Starlette is a lightweight ASGI framework/toolkit, which is ideal for building async web services in Python. It is production-ready, and gives you the following: =E2=80=A2 A lightweight, low-complexity HTTP web framework. =E2=80=A2 WebSocket support. =E2=80=A2 In-process background tasks. =E2=80=...

[SECURITY] Fedora 42 Update: python-starlette-0.47.3-2.fc42

Starlette is a lightweight ASGI framework/toolkit, which is ideal for building async web services in Python. It is production-ready, and gives you the following: =E2=80=A2 A lightweight, low-complexity HTTP web framework. =E2=80=A2 WebSocket support. =E2=80=A2 In-process background tasks. =E2=80=...

CVE-2025-63713

A Cross-Site Scripting (XSS) vulnerability exists in SourceCodester "MatchMaster" 1.0 . The flaw is caused by the application's failure to properly sanitize user-supplied input in test titles and matching pair items before rendering them in the DOM during test execution. This allows remote attack...

PT-2025-45477

Name of the Vulnerable Software and Affected Versions MatchMaster version 1.0 Description A Cross-Site Scripting XSS issue exists in MatchMaster. The application does not properly sanitize user-supplied input in test titles and matching pair items before rendering them in the DOM during test...

CVE-2025-63713: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting XSS vulnerability in SourceCodester "MatchMaster" 1.0 allows remote attackers to inject arbitrary web script or HTML via crafted input in the custom test creation feature. The vulnerability exists because the application fails to properly sanitize user-supplied input in test...

CVE-2025-63713

Cross-Site Scripting XSS vulnerability in SourceCodester "MatchMaster" 1.0 allows remote attackers to inject arbitrary web script or HTML via crafted input in the custom test creation feature. The vulnerability exists because the application fails to properly sanitize user-supplied input in test...

CVE-2025-63713

Cross-Site Scripting XSS vulnerability in SourceCodester "MatchMaster" 1.0 allows remote attackers to inject arbitrary web script or HTML via crafted input in the custom test creation feature. The vulnerability exists because the application fails to properly sanitize user-supplied input in test...

CVE-2025-12469

The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.6.4.1. This is due to the plugin not properly verifying that a user is authorized to perform administrativ...

CLSA-2025-1762419767 Fix CVE(s): CVE-2022-3296

SECURITY UPDATE: Stack-based Buffer Overflow with unexpected :finally - debian/patches/CVE-2022-3296.patch: check CSFTRY can be found - CVE-2022-3296 Fix Testterminalnoblock - debian/patches/fix-flaky-terminal-noblock-test.patch...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990568)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990568 advisory. In the Linux kernel, the following vulnerability has been resolved: locking/wwmutex/test: Fix potential workqueue corruption In some cases running with the...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990478)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990478 advisory. In the Linux kernel, the following vulnerability has been resolved: llc: verify mac len before reading mac header LLC reads the mac header with ethhdr without...