In JetBrains Toolbox App before 1.15.5666 for Windows, privilege escalation was possible.

...

JetBrains Toolbox before 1.15.5605 was resolving an internal URL via a cleartext http connection.

...

PC-Doctor Toolbox before 7.3 has an Uncontrolled Search Path Element.

...

atacworks (0.3.3), john-toolbox (>=0.1.0, <=0.3.1) potentially affected by CVE-2025-59842 via jupyterlab (2.1.5)

jupyterlab PYPI version 2.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - atacworks 0.3.3 - john-toolbox =0.1.0, =0.3.1 Source cves: CVE-2025-59842 Source advisory: OSV:GHSA-VVFJ-2JQX-52JM...

ae-toolbox (0.2.0), aihwkit (>=0.7.0, <=0.7.1) +60 more potentially affected by CVE-2025-55557 via torch (1.13.0)

torch PYPI version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on torch and may be impacted: - ae-toolbox 0.2.0 - aihwkit =0.7.0, =0.1.0, =1.0.14, =1.0.1, =0.1.15, =0.0.9, =0.3.0, =0.1.0, =0.1.8rc3, =0.1.8rc4 and more Source cves: CVE-2025-5555...

ae-toolbox (0.2.0), aihwkit (>=0.7.0, <=0.7.1) +60 more potentially affected by CVE-2025-55552 via torch (1.13.0)

torch PYPI version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on torch and may be impacted: - ae-toolbox 0.2.0 - aihwkit =0.7.0, =0.1.0, =1.0.14, =1.0.1, =0.1.15, =0.0.9, =0.3.0, =0.1.0, =0.1.8rc3, =0.1.8rc4 and more Source cves: CVE-2025-5555...

ae-toolbox (0.2.0), aihwkit (>=0.7.0, <=0.7.1) +60 more potentially affected by CVE-2025-55551 via torch (1.13.0)

torch PYPI version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on torch and may be impacted: - ae-toolbox 0.2.0 - aihwkit =0.7.0, =0.1.0, =1.0.14, =1.0.1, =0.1.15, =0.0.9, =0.3.0, =0.1.0, =0.1.8rc3, =0.1.8rc4 and more Source cves: CVE-2025-5555...

azure-arm-nb-extensions (>=0.0.1, <=0.0.2), cfn-docgen (>=0.0.1, <=0.1.4) +1 more potentially affected by CVE-2025-8869 via pip (20.2.3)

pip PYPI version 20.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - azure-arm-nb-extensions =0.0.1, =0.0.1, =0.0.8, =0.0.11 Source cves: CVE-2025-8869 Source advisory: OSV:GHSA-4XH5-X5GV-QWPH...

CVE-2025-10236

A vulnerability has been found in binary-husky gptacademic up to 3.91. Impacted is the function mergetexfiles of the file crazyfunctions/latexfns/latextoolbox.py of the component LaTeX File Handler. Such manipulation of the argument \input leads to path traversal. The attack may be launched...

Malicious code in crew-toolbox (npm)

The package crew-toolbox was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 814628864e80153a94f63be13a31cda738fad89160a114cb24559afb0fdbf60f Any computer that has this package installed or running should be considered fully...

Malicious Package

Overview crew-toolbox is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2025-47056 Malicious code in crew-toolbox (npm)

The package crew-toolbox was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 814628864e80153a94f63be13a31cda738fad89160a114cb24559afb0fdbf60f Any computer that has this package installed or running should be considered fully...

Malware in crew-toolbox

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2025-10236

A vulnerability has been found in binary-husky gptacademic up to 3.91. Impacted is the function mergetexfiles of the file crazyfunctions/latexfns/latextoolbox.py of the component LaTeX File Handler. Such manipulation of the argument \input leads to path traversal. The attack may be launched...

CVE-2025-10236 binary-husky gpt_academic LaTeX File latex_toolbox.py merge_tex_files_ path traversal

A vulnerability has been found in binary-husky gptacademic up to 3.91. Impacted is the function mergetexfiles of the file crazyfunctions/latexfns/latextoolbox.py of the component LaTeX File Handler. Such manipulation of the argument \input leads to path traversal. The attack may be launched...

CVE-2025-10236

CVE-2025-10236 affects binary-husky gpt_academic up to version 3.91. The vulnerability resides in the LaTeX File Handler’s merge_tex_files_ function inside crazy_functions/latex_fns/latex_toolbox.py, where untrusted input passed to the \

GPT Academic path traversal vulnerability

GPT Academic is an interface by the individual developer binary-husky to provide pragmatic interactions for LLM large language models such as GPT/GLM. A path traversal vulnerability exists in GPT Academic 3.91 and earlier, which stems from a misbehavior with the parameter input in the file...

fourdexplorer (0.5.9), pyppg (>=1.0.15, <=1.0.73) +4 more potentially affected by CVE-2025-59042 via pyinstaller (5.5.0)

pyinstaller PYPI version 5.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyinstaller and may be impacted: - fourdexplorer 0.5.9 - pyppg =1.0.15, =1.0.0, =1.0.9 - systembridgebackend 3.4.9 - systembridgecli 3.4.9 - ttygotcha 1.0.1 Source cves:...

Fedora: Security Advisory (FEDORA-2025-ab370b9ac9)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 41 : toolbox (2025-ab370b9ac9)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-ab370b9ac9 advisory. Security fixes Bumped the minimum github.com/go-viper/mapstructure/v2 version to 2.3.0 for GHSA-fv92-fjc5-jj9h or GO-2025-3787 Bumped the minimum...