9922 matches found
WordPress Plugin SiteSEO Authorization Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. An authorizati...
CVE-2025-63603
A command injection vulnerability exists in the MCP Data Science Server's reading-plus-ai/mcp-server-data-exploration 0.1.6 in the safeeval function src/mcpserverds/server.py:108. The function uses Python's exec to execute user-supplied scripts but fails to restrict the builtins dictionary in the...
PT-2025-47332
Name of the Vulnerable Software and Affected Versions baryhuang/mcp-server-aws-resources-python version 0.1.0 Description A code injection issue exists due to insufficient input validation in the execute query method. This allows for remote code execution by exposing dangerous Python built-in...
netfilter IDLETIMER Buffer Overflow DoS
The vulnerability of the idletimertgcreate function in the net/netfilter/xtIDLETIMER.c module of the netfilter component in the Linux operating system’s kernel is related to the use of uninitialized variables. Exploiting this vulnerability could allow an attacker to cause a service failure...
Arbitrary Code Execution(ACE)
Expr-eval is vulnerable to Arbitrary Code ExecutionACE. The vulnerability is due to insufficient input validation in the evaluate function, which allows an attacker to supply a crafted variables object and execute arbitrary code...
CVE-2025-64726
Socket Firewall is an HTTP/HTTPS proxy server that intercepts package manager requests and enforces security policies by blocking dangerous packages. Socket Firewall binary versions separate from installers prior to 0.15.5 are vulnerable to arbitrary code execution when run in untrusted project...
EUVD-2025-180388
Malicious code in apollo-dotenv-parse-variables-stratigraphy-private npm...
EUVD-2025-175920
Malicious code in tool-dotenv-parse-variables-gravitationalwave-luna npm...
EUVD-2025-177646
Malicious code in neptunology-husky-dotenv-parse-variables-got npm...
EUVD-2025-179634
Malicious code in commitlint-config-angular-forever-dotenv-parse-variables-google npm...
EUVD-2025-180461
Malicious code in algol-apollo-dotenv-parse-variables-browserify npm...
EUVD-2025-178183
Malicious code in koa-eslint-plugin-corvus-dotenv-parse-variables npm...
EUVD-2025-179264
Malicious code in dotenv-parse-variables-init-child-process-genomics npm...
EUVD-2025-178493
Malicious code in hugo-wavefunction-dotenv-parse-variables-parallax npm...
EUVD-2025-178832
Malicious code in framework-writable-dotenv-parse-variables-yonder npm...
EUVD-2025-179267
Malicious code in dotenv-parse-variables-astrobiology-readable-magellan npm...
EUVD-2025-179007
Malicious code in event-bootes-dotenv-parse-variables-ursa npm...
MAL-2025-186618 Malicious code in dotenv-parse-variables-init-child-process-genomics (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98640b4344bddcf7df3cfc9d3664fa0d315971b9d3d25520d63786b5a4be8e0c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...