Malicious Package

Overview ansi-universal-ui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

PT-2026-5959

Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description A flaw exists in Moodle due to improper sanitization of AI prompt responses. This allows attackers to inject malicious HTML or script into web pages. Successful exploitation could lead to...

CVE-2025-61655: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation VisualEditor. This vulnerability is associated with program files includes/ApiVisualEditorEdit.Php, modules/ve-mw/init/targets/ve.Init.Mw.DesktopArticleTarget.Js,...

CVE-2025-61644: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Rcfilters/ui/WatchlistTopSectionWidget.Js. This issue affects MediaWiki: from befo...

CVE-2025-67849: Improper Neutralization of Input During Web Page Generation

A flaw was found in Moodle. This cross-site scripting XSS vulnerability, caused by improper sanitization of AI prompt responses, allows attackers to inject malicious HTML or script into web pages. When other users view these compromised pages, their sessions could be stolen, or the user interface...

CVE-2025-36033: Improper Neutralization of Input During Web Page Generation

IBM Engineering Lifecycle Management - Global Configuration Management 7.0.3 through 7.0.3 Interim Fix 017, and 7.1.0 through 7.1.0 Interim Fix 004 IBM Global Configuration Management is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary...

Fedora 43 : openttd (2026-dd8314c4f3)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-dd8314c4f3 advisory. 15.x 15.1 2026-01-24 - Fix 15088: When building a new train, the refit button state may be incorrect 15162 - Fix 15160: Incorrect company names displayed in...

Google Chrome < 104.0.5112.102 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 104.0.5112.102. It is, therefore, affected by multiple vulnerabilities as referenced in the 202208stable-channel-update-for-desktop16 advisory. - Use after free in Browser Creation in Google Chrome prior to 104.0.5112.1...

CVE-2025-36436 Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for January 2026.

IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 007 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web...

@firedesktop/react-portal-base (2.1.2), @imaginario27/air-ui-utils (>=1.0.8, <=1.0.9) +4 more potentially affected by CVE-2026-24737 via jspdf (4.0.0)

jspdf NPM version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on jspdf and may be impacted: - @firedesktop/react-portal-base 2.1.2 - @imaginario27/air-ui-utils =1.0.8, =1.4.0-I18n-QM, =0.5.129, =4.4.0, =4.4.1 - svgedit 7.4.1 Source cves:...

PT-2026-31500

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 147.0.7727.55 Description A flaw in Google Chrome's fullscreen mode allowed an attacker to perform UI spoofing using a specially crafted HTML page. This could potentially trick users into interacting with a fake...

CVE-2025-36436: Improper Neutralization of Input During Web Page Generation

IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 007 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web...

LoLLMs WEBUI 安全漏洞

LoLLMs WEBUI is a large-scale model web user interface developed by Saifeddine ALOUI, which supports integration of multiple models and modalities. LoLLMs WEBUI has a security vulnerability; this vulnerability stems from the name parameter in the /reinstallextension endpoint containing local file...

Fedora 43 : cef (2026-c5295ae3b9)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c5295ae3b9 advisory. Update to cef-144.0.11+ge135be2 + chromium 144.0.7559.96 rhbz2432335 CVE-2026-1220: Race in V8 CVE-2026-0899: Out of bounds memory access in V8...

EUVD-2026-4950

Budibase is a low code platform for creating internal tools, workflows, and admin panels. In versions up to and including 3.26.3, a Creator-level user, who normally has no UI permission to invite users, can manipulate API requests to invite new users with any role, including Admin, Creator, or Ap...

CVE-2025-69929

An issue in N3uron Web User Interface v.1.21.7-240207.1047 allows a remote attacker to escalate privileges via the password hashing on the client side using the MD5 algorithm over a predictable string format...

xtream-ui-security-audit

🔐 Xtream UI Security Audit & Exploitation Framework !Python...

PT-2026-5360

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.26.4 Description Budibase is a low code platform used for building internal tools, workflows, and admin panels. A Creator-level user, normally lacking UI permissions to invite users, can manipulate API requests to...

7ghost (>=4.11.0, <=4.11.46), @accordproject/concerto-ui-react (>=0.6.0-alpha.1, <=0.83.1-20200224151908) +271 more potentially affected by CVE-2025-61140 via jsonpath (>=1.0.0, <=1.1.1)

jsonpath NPM version =1.0.0, =4.11.0, =0.6.0-alpha.1, =0.82.10-20200221024018, =1.0.0, =1.1.0-dev.2, =3.0.6371, =4.0.2, =2.0.4, =0.2.0-dev.1, =4.0.149, =3.0.129, =4.0.174, =0.11.8, =1.2.5, =1.4.0 and more Source cves: CVE-2025-61140 Source advisory: OSV:GHSA-6C59-MWGH-R2X6...

Malicious Package

Overview mindmeld-ui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...