MAL-2025-191963 Malicious code in karemm1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48612b0b1dd13d62c19284c76e6d5c16b29512f42c35ba20ad6243ba89c6d647 The package karemm1 was found to contain malicious code. Source: ossf-package-analysis 0f87456104eeeb78cac0cdb21d017530153ecae93b9e675b0d14f83d365c7b...

Malicious code in karem10 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02ecf4d35a03a77c6c6665e814830b4111dd4c3e969a800697b3ca6dc0eeaebc The package karem10 was found to contain malicious code. Source: ossf-package-analysis d2bf23a7af43498c68b78f4d0e45aa2dec25a1ea950bc0c7b9b0d880ec35b9...

Malicious code in karem4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a1d3bd676881934532a2e75fd644e22b2e4f26fb08bde6d48ff6d529de7467d The package karem4 was found to contain malicious code. Source: ossf-package-analysis b843a0d849da7453ce803b77a117a501a3b1e4b04eae8222d3b59d48438931c...

MAL-2025-191947 Malicious code in karemz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0210683c3480535deb828dc6e3f758815b2a57ae4a50c37dca6443ad61623aa4 The package karemz was found to contain malicious code. Source: ossf-package-analysis 0ea2cd139758da9c9339894a56f0250a834c2fb01f4b25c9e398daef8c61c99...

Malicious code in kmz1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 764e3cb5b5016e17afcd37b7b263ec2575af32008338ff14e72dd73b1d82bfa1 The package kmz1 was found to contain malicious code. Source: ossf-package-analysis 2a6ae2284037ed233d5af5263950214a55a620b61dde2f0b12669eced34b1957...

ProudMuBai GoFilm 代码问题漏洞

ProudMuBai GoFilm is a multi-player auto-capture online movie and TV site by ProudMuBai's personal developer. A code issue vulnerability exists in ProudMuBai GoFilm version 1.0.0 and 1.0.1, which stems from insufficient validation of the File parameter in the SingleUpload function in the...

Security Bulletin: Astronomer with IBM is vulnerable to object abuse due to Kubernetes (CVE-2025-5187)

Summary Kubernetes is used by Astronomer with IBM as part of service management functionality. Vulnerability Details CVEID:CVE-2025-5187 DESCRIPTION: A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node obje...

Security Bulletin: Astronomer with IBM is vulnerable to server-side request forgery due to the node-ip package (CVE-2025-59436, CVE-2025-59437)

Summary Node-ip is used by Astronomer with IBM as part of IP address processing functionality. Vulnerability Details CVEID:CVE-2025-59436 DESCRIPTION: The ip aka node-ip package through 2.0.1 in NPM might allow SSRF because the IP address value 017700000001 is improperly categorized as globally...

MAL-2025-191482 Malicious code in wartsila-application-json (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e0377e0cb41b793d9733d21ccf71ee44de194a8988cbbd874d88c3cb5e03cce The package wartsila-application-json was found to contain malicious code. Source: ghsa-malware...

CVE-2025-12586

The Conditional Maintenance Mode for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation when toggling the maintenance mode status. This makes it possible for unauthenticated attackers to...

CVE-2025-12586 Conditional Maintenance Mode for WordPress <= 1.0.0 - Cross-Site Request Forgery

The Conditional Maintenance Mode for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation when toggling the maintenance mode status. This makes it possible for unauthenticated attackers to...

EUVD-2025-199579

The Conditional Maintenance Mode for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation when toggling the maintenance mode status. This makes it possible for unauthenticated attackers to...

EUVD-2025-199581

The Zweb Social Mobile – Ứng Dụng Nút Gọi Mobile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘vithanhlamzsocialsavemessager’, 'vithanhlamzsocialsavezalo', 'vithanhlamzsocialsavehotline', and 'vithanhlamzsocialsavecontact' parameters in all versions up to, and...

WordPress Conditional Maintenance Mode for WordPress plugin <= 1.0.0 - Cross-Site Request Forgery vulnerability

Cross-Site Request Forgery vulnerability discovered by dayea song - Ahnlab in WordPress Plugin Conditionnal Maintenance Mode for WordPress versions = 1.0.0...

PT-2025-47999

The Conditional Maintenance Mode for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation when toggling the maintenance mode status. This makes it possible for unauthenticated attackers to...

@cycle-mega-driver/database (>=0.2.1 <=0.3.2), @fluidnotions/rx-pouch (>=0.6.7 <=0.6.8) +2 more potentially affected by unknown CVE via flatten-unflatten (=1.0.0)

flatten-unflatten NPM version =1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on flatten-unflatten and may be impacted: - @cycle-mega-driver/database =0.2.1, =0.6.7, =1.0.0, =0.3.0, =0.6.9 Source cves: unknown CVE Source advisory:...

cleanwork (=0.0.1), tomvisions-toolkit (>=1.0.1 <=1.0.9) potentially affected by unknown CVE via image-to-uri (=1.0.0)

image-to-uri NPM version =1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on image-to-uri and may be impacted: - cleanwork =0.0.1 - tomvisions-toolkit =1.0.1, =1.0.9 Source cves: unknown CVE Source advisory: SNYK:JS-IMAGETOURI-14103641...

@amorist/gatsby-theme-antd (=1.0.0), @antv/f2-site (>=4.0.0-4.0.0-alpha.3.0 <=5.0.1-beta.0) +16 more potentially affected by unknown CVE via gatsby-plugin-cname (=1.0.0)

gatsby-plugin-cname NPM version =1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on gatsby-plugin-cname and may be impacted: - @amorist/gatsby-theme-antd =1.0.0 - @antv/f2-site =4.0.0-4.0.0-alpha.3.0, =0.9.81, =1.0.0, =1.1.18-beta.0, =0.0.1, =0.0.4,...

WordPress Tainacan plugin <= 1.0.0 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Peb - NA in WordPress Plugin Tainacan versions = 1.0.0...

CVE-2025-12747 Tainacan <= 1.0.0 - Unauthenticated Information Exposure

The Tainacan plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.0 via uploaded files marked as private being exposed in wp-content without adequate protection. This makes it possible for unauthenticated attackers to extract potentially sensitive...