CVE-2025-11749: Exposure of Sensitive Information to an Unauthorized Actor

The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the /mcp/v1/ REST API endpoint that exposes the 'Bearer Token' value when 'No-Auth URL' is enabled. This makes it possible for unauthenticated attackers to extract th...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-989509)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989509 advisory. In the Linux kernel, the following vulnerability has been resolved: ipv4: prevent potential spectre v1 gadget in fibmetricsmatch if !type continue; if type RTAXMAX...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-990207)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990207 advisory. In the Linux kernel, the following vulnerability has been resolved: ipv4: prevent potential spectre v1 gadget in fibmetricsmatch if !type continue; if type RTAXMAX...

PT-2025-45728

Impact Missing authentication in the /api/v1/usage-report/summary endpoint allows anyone to retrieve aggregate API usage counts. While no sensitive data is disclosed, the endpoint may reveal information about service activity or uptime. Patches Upgrade to v1.70.1 Workarounds Any ONE of these is...

Malicious code in balancer-labs-sor-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 913cc298291011f049211a4379e100f5ca724f09b512b5fdfcc84fd0f1df3caa The package balancer-labs-sor-v1 was found to contain malicious code. Source: ossf-package-analysis...

MAL-2025-49311 Malicious code in balancer-labs-sor-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 913cc298291011f049211a4379e100f5ca724f09b512b5fdfcc84fd0f1df3caa The package balancer-labs-sor-v1 was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in @gitlab-test/bun-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ac471c58a2d40a399987d96cf13593df041d1f3baa4d4e19e047d1090a931f6a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-12268: Unrestricted Upload of File with Dangerous Type

A vulnerability has been found in LearnHouse up to 98dfad76aad70711a8113f6c1fdabfccf10509ca. Impacted is an unknown function of the file /api/v1/courses/ of the component Course Thumbnail Handler. The manipulation of the argument thumbnail leads to unrestricted upload. It is possible to initiate...

EUVD-2025-35141

Malicious code in park-boost-v1 npm...

Malicious code in park-boost-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aa4995e481e7e195eba9f71a64e7cfddf3fbcb8004d9eda6edb78c022875441f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview park-boost-v1 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2025-48535 Malicious code in park-boost-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aa4995e481e7e195eba9f71a64e7cfddf3fbcb8004d9eda6edb78c022875441f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE CVE-2025-61907

Icinga 2 is an open source monitoring system. In Icinga 2 versions 2.4 through 2.15.0, filter expressions provided to the various /v1/objects endpoints could access variables or objects that would otherwise be inaccessible for the user. This allows authenticated API users to learn information tha...

CVE-2025-61907

Icinga 2 is an open source monitoring system. In Icinga 2 versions 2.4 through 2.15.0, filter expressions provided to the various /v1/objects endpoints could access variables or objects that would otherwise be inaccessible for the user. This allows authenticated API users to learn information tha...

CVE-2025-6893: Execution with Unnecessary Privileges

An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers. A flaw in broken access control has been identified in the /api/v1/setting/data endpoint of the affected device. This flaw allows a low-privileged authenticated user to ca...

UBUNTU-CVE-2025-61907

Icinga 2 is an open source monitoring system. In Icinga 2 versions 2.4 through 2.15.0, filter expressions provided to the various /v1/objects endpoints could access variables or objects that would otherwise be inaccessible for the user. This allows authenticated API users to learn information tha...

CVE-2025-61907

Icinga 2 is an open source monitoring system. In Icinga 2 versions 2.4 through 2.15.0, filter expressions provided to the various /v1/objects endpoints could access variables or objects that would otherwise be inaccessible for the user. This allows authenticated API users to learn information tha...

EUVD-2025-34794

Icinga 2 is an open source monitoring system. In Icinga 2 versions 2.4 through 2.15.0, filter expressions provided to the various /v1/objects endpoints could access variables or objects that would otherwise be inaccessible for the user. This allows authenticated API users to learn information tha...

CVE-2025-61907: Exposure of Sensitive Information to an Unauthorized Actor

Icinga 2 is an open source monitoring system. In Icinga 2 versions 2.4 through 2.15.0, filter expressions provided to the various /v1/objects endpoints could access variables or objects that would otherwise be inaccessible for the user. This allows authenticated API users to learn information tha...

PT-2025-42511

Name of the Vulnerable Software and Affected Versions Icinga 2 versions 2.4 through 2.15.0 Description Icinga 2 is an open source monitoring system. Filter expressions provided to the /v1/objects API endpoints could access variables or objects that would otherwise be inaccessible for the user. Th...