Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. Compromised versions of this package contain a file called bundle.js that exfiltrates secrets from the user's accounts, including credentials and API tokens. It also downloads malicious files and repackages them...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. Compromised versions of this package contain a file called bundle.js that exfiltrates secrets from the user's accounts, including credentials and API tokens. It also downloads malicious files and repackages them...

Insecure Deserialization

picklescan is vulnerable to insecure deserialization. The vulnerability is due to the use of torch.utils.bottleneck.main.runcprofile function to execute remote pickle files, which allows an attacker to run arbitrary code...

Malicious Package

Overview eth-node-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2025-47179 Malicious code in eth-node-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 43e3bae1d6be9bca527622368d2a291d97b40692ce8996525eefb78917c7e0de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

clusterd

This is an open-source application server attack toolkit called clusterd. It automates the fingerprinting, reconnaissance, and exploitation phases of an application server attack. The toolkit currently supports six different application server platforms, with several more in development and...

CVE-2025-10398 fcba_zzm ics-park Smart Park Management System FileUploadUtils.java unrestricted upload

A security flaw has been discovered in fcbazzm ics-park Smart Park Management System 2.0. This vulnerability affects unknown code of the file FileUploadUtils.java. The manipulation of the argument File results in unrestricted upload. The attack can be launched remotely. The exploit has been...

CVE-2025-10398

CVE-2025-10398 affects fcba_zzm ics-park Smart Park Management System 2.0. The vulnerability is in FileUploadUtils.java where manipulation of the File parameter enables unrestricted upload. Exploitation is possible remotely and public exploits are reported. Multiple connected sources corroborate ...

OESA-2025-2275 binutils security update

Binutils is a collection of binary utilities, including ar for creating, modifying and extracting from archives, as a family of GNU assemblers, gprof for displaying call graph profile data, ld the GNU linker, nm for listing symbols from object files, objcopy for copying and translating object...

WordPress MyBrain Utilities plugin cross-site scripting vulnerability

WordPress MyBrain Utilities plugin is a plugin for enhancing the functionality of your website, mainly for optimizing the performance and user experience. A cross-site scripting vulnerability exists in the WordPress MyBrain Utilities plugin that stems from insufficient input cleanup and output...

MAL-2025-47040 Malicious code in @liquid-web/utils (npm)

The package @liquid-web/utils was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 02e29a386f30eacfd4a3e7023262f0bb759557fb0a41790632720ff54b920a8d Any computer that has this package installed or running should be considered fully...

The vulnerability of the cifs.upcall function in the CIFS network file system mounting utility package cifs-utils allows a attacker to disclose sensitive information.

The vulnerability of the cifs.upcall function in the CIFS network file system mounting utility package cifs-utils relates to the provision of error session data elements. Exploiting this vulnerability can allow attackers to disclose sensitive information that is protected by security measures...

Malicious code in @js-to-lua/lua-conversion-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 91ebd24fd672684df83e5fcae05558a53e1c39f90617cac87401a555dda40811 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview @js-to-lua/lua-conversion-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and th...

MAL-2025-47007 Malicious code in @js-to-lua/lua-conversion-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 91ebd24fd672684df83e5fcae05558a53e1c39f90617cac87401a555dda40811 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-10126 MyBrain Utilities <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

The MyBrain Utilities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugins's 'mbumap' shortcode in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-10126

CVE-2025-10126 affects the WordPress MyBrain Utilities plugin (mbumap shortcode) up to version 1.0.8. Root cause: insufficient input sanitization and output escaping on user-supplied shortcode attributes, enabling Stored Cross-Site Scripting. Impact: authenticated attackers withContributor+ privi...

[SECURITY] Fedora 41 Update: rust-tracing-subscriber-0.3.20-1.fc41

Utilities for implementing and composing tracing subscribers...

PT-2025-37008

Name of the Vulnerable Software and Affected Versions: MyBrain Utilities plugin for WordPress versions up to and including 1.0.8 Description: The MyBrain Utilities plugin for WordPress is susceptible to Stored Cross-Site Scripting through the mbumap shortcode due to inadequate input sanitization...

CVE-2025-10126: Improper Neutralization of Input During Web Page Generation

The MyBrain Utilities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugins's 'mbumap' shortcode in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...