MAL-2025-63825 Malicious code in kiki-sambel18-sumpek (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85fd8c73cec29b127d821acf7a49d6d862b6d1a0b4190b9370347d9028ebb3a0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

PT-2025-46532

Name of the Vulnerable Software and Affected Versions Grafana Databricks Datasource Plugin versions 1.12.1 through 1.12.0 Description The Grafana Databricks Datasource Plugin has an issue where, with Oauth passthrough enabled, multiple users sharing a single Grafana instance and datasource may...

PT-2025-46408

Name of the Vulnerable Software and Affected Versions IntelR One Boot Flash Update IntelR OFU versions prior to 14.1.31 Description The software has default permissions that may allow a privilege escalation. An unprivileged software adversary with an authenticated user and a complex attack may...

PT-2025-46438

Name of the Vulnerable Software and Affected Versions IntelR PROSet/Wireless WiFi Software for Windows versions prior to 23.160 Description An out-of-bounds write issue exists in IntelR PROSet/Wireless WiFi Software for Windows. This flaw, located within Ring 2: Device Drivers, could allow for a...

PT-2025-46422

Name of the Vulnerable Software and Affected Versions IntelR QAT Windows software versions prior to 2.6.0 Description An out-of-bounds read issue exists in some IntelR QAT Windows software. A system software adversary with an authenticated user and a high complexity attack may be able to cause a...

MAL-2025-57969 Malicious code in ogi-kacang51-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d543248b450558300ee5ef6b446ddd8715d6e53e961e8994b82af081f48cf171 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in putri-donat60-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d4302848a127424f40a74202176fdf311fe8727496cfab450cf69b58124009b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hanafi-tiwul78-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9b244749d7ae618b401e98e506607a0befceaddf598683f83e6760ca4ed4db7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

PT-2025-46156

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2025.3.104432 Description Improper access control in JetBrains YouTrack allowed modification of MCP tool logic. Recommendations Update to version 2025.3.104432 or later...

PT-2025-46150

Name of the Vulnerable Software and Affected Versions JetBrains Hub versions prior to 2025.3.104992 Description A race condition existed that allowed bypassing the user limit through invitations. Recommendations Update JetBrains Hub to version 2025.3.104992 or later...

PT-2025-45555

Name of the Vulnerable Software and Affected Versions Better Find and Replace – AI-Powered Suggestions plugin for WordPress versions through 1.7.7 Description The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is susceptible to Limited Code Injection. This is a result of...

PT-2025-45180

Name of the Vulnerable Software and Affected Versions Better Find and Replace – AI-Powered Suggestions plugin for WordPress versions through 1.7.7 Description The software is susceptible to unauthorized API usage because of a missing capability check within the rtafar ajax function. This allows...

Google Chrome Security Update (stable-channel-update-for-desktop-2025-11) - Windows

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

[SECURITY] Fedora 43 Update: rust-attribute-derive-macro-0.10.5-1.fc43

Clap for proc macro attributes...

PT-2025-45154

Name of the Vulnerable Software and Affected Versions Quipux versions 4.0.1 through e1774ac Description A Cross Site Scripting issue exists in Quipux. The issue is located in the anexos/anexos nuevo.php file, specifically within the asocImgRad parameter. Recommendations Update Quipux to a version...

PT-2025-45093

Name of the Vulnerable Software and Affected Versions KiotViet Sync plugin for WordPress versions up to and including 1.8.5 Description The KiotViet Sync plugin for WordPress is susceptible to unauthorized data modification. This is due to a missing capability check within the saveConfig function...

Progress Flowmon vulnerable to authenticated OS command injection

Overview Progress Flowmon provided by Progress Software Corporation contains the following vulnerability. Authenticated OS command injection CWE-78 - CVE-2025-10239 Kentaro Kawane of GMO Cybersecurity by Ierae reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

TencentOS Server 4: exiv2 (TSSA-2025:0843)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0843 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

PT-2025-45062

Name of the Vulnerable Software and Affected Versions Cursor versions 1.7.44 and below Description Cursor, a code editor for programming with AI, has an issue where NTFS path quirks can be exploited by an attacker to bypass file protections and overwrite files that normally require user...

PT-2025-44748

Name of the Vulnerable Software and Affected Versions PHPGurukul News Portal version 1.0 Description A security issue exists in PHPGurukul News Portal. Manipulation of the SECRET KEY argument within an unknown function in the /onps/settings.py file results in the use of a hard-coded cryptographic...