4543 matches found
MAL-2025-47019 Malicious code in jsexports-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3faa85960d0da372c3591bd8e6336208f04090cc24ca88b734d8e84d5f389c16 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious Package
Overview jsexports-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Linux Distros Unpatched Vulnerability : CVE-2022-24279
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The package madlib-object-utils before 0.1.8 are vulnerable to Prototype Pollution via the setValue method, as it allows an attacker to merge object prototypes...
Linux Distros Unpatched Vulnerability : CVE-2025-6224
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the netwo...
arbor-ai (>=0.1.5 <=0.1.14), coreason-runtime (>=0.1.0 <=0.31.0) +10 more potentially affected by CVE-2025-10164 via sglang (>=0.4.5 <=0.5.2)
sglang PYPI version =0.4.5, =0.1.5, =0.1.0, =1.1.0, =2.0.0b40, =0.0.1, =0.1.0, =0.1.0, =0.0.1.post1, =0.0.0, =0.8.0, =0.10.7 Source cves: CVE-2025-10164 Source advisory: OSV:GHSA-9W53-XR52-MWGJ...
@altipla/directus-sdk-utils (=0.7.2), @angular/build (>=20.2.0 <=21.0.0-rc.1) +48 more potentially affected by CVE-2025-58751 via vite (>=7.1.0 <=7.1.4)
vite NPM version =7.1.0, =20.2.0, =2.1.2-alpha.0, =0.0.0, =2.14.0, =5.0.0-beta.4, =30.0.0, =16.0.1, =2.19.8, =2.19.8, =14.314.0, =9.6.3, =0.0.12, =2.14.2, =2.14.4 and more Source cves: CVE-2025-58751 Source advisory: OSV:GHSA-G4JQ-H2W9-997C...
arbor-ai (>=0.1.5 <=0.1.14), coreason-runtime (>=0.1.0 <=0.31.0) +9 more potentially affected by CVE-2025-10164 via sglang (>=0.4.6.post5 <=0.5.2)
sglang PYPI version =0.4.6.post5, =0.1.5, =0.1.0, =1.1.0, =2.0.0b40, =0.0.1, =0.1.0, =0.1.0, =0.0.1.post1, =0.0.0, =0.8.0, =0.10.7 Source cves: CVE-2025-10164 Source advisory: SNYK:PYTHON-SGLANG-12705358...
@altipla/directus-sdk-utils (=0.7.2), @angular/build (>=20.2.0 <=21.0.0-rc.1) +48 more potentially affected by CVE-2025-58752 via vite (>=7.1.0 <=7.1.4)
vite NPM version =7.1.0, =20.2.0, =2.1.2-alpha.0, =0.0.0, =2.14.0, =5.0.0-beta.4, =30.0.0, =16.0.1, =2.19.8, =2.19.8, =14.314.0, =9.6.3, =0.0.12, =2.14.2, =2.14.4 and more Source cves: CVE-2025-58752 Source advisory: SNYK:JS-VITE-12558116...
CodeceptJS's incomprehensive sanitation can lead to Command Injection
CodeceptJS versions 3.5.0 through 3.7.5-beta.18 contain a command injection vulnerability in the emptyFolder function lib/utils.js. The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary...
MAL-2025-46148 Malicious code in string-modifier-utils (npm)
The package string-modifier-utils was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...
CVE-2025-26439
In getComponentName of AccessibilitySettingsUtils.java, there is a possible way to for a malicious Talkback service to be enabled instead of the system component due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User...
Use of Incorrectly-Resolved Name or Reference
Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference via the getPath function in the utils/url.ts file. An attacker can gain unauthorized access to protected endpoints by sending specially craft...
MAL-2025-47755 Malicious code in data-processing-utils (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 f5c7542831f6f9fe72a65e436b1f85c10261aac12ceae6f1bcc490afad6d1aaa Installing packages exfiltrates data different in different packages and versions or run revshells --- Category: MALICIOUS - The campaign has clearly malicious...
CVE-2025-9796 thinkgem JeeSite EncodeUtils.java decodeUrl2 cross site scripting
A vulnerability was found in thinkgem JeeSite up to 5.12.1. This affects the function decodeUrl2 of the file common/src/main/java/com/jeesite/common/codec/EncodeUtils.java. The manipulation results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made...
Malicious code in react-native-wm-utils (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 790e08de4e57c51f573e613b7cdd780343c4f14a00aadaff30e05fca9cb69f8b Any computer that has this package installed or running should be considered...
MAL-2025-45766 Malicious code in react-native-wm-utils (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 790e08de4e57c51f573e613b7cdd780343c4f14a00aadaff30e05fca9cb69f8b Any computer that has this package installed or running should be considered...
Malicious code in internal-helper-utils (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...
Thinkgem JeeSite 安全漏洞
Thinkgem JeeSite is an open source Java EE enterprise-class rapid development platform of China Zhuo Yuan Thinkgem company . The platform includes system permissions components , data permissions components , data dictionary components , core tools components , view manipulation components ,...
Linux Distros Unpatched Vulnerability : CVE-2025-52968
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. For example, xdg-open could be modified to,...