Cleartext Storage of Sensitive Information

Overview local-deep-research is an AI-powered research assistant with deep, iterative analysis using LLMs and web searches Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information in a local SQLite database. An attacker can access sensitive information,...

CVE-2025-57806 Local Deep Research's API keys are stored in plain text

Local Deep Research is an AI-powered research assistant for deep, iterative research. Versions 0.2.0 through 0.6.7 stored confidential information, including API keys, in a local SQLite database without encryption. This behavior was not clearly documented outside of the database architecture page...

PT-2025-35648

Name of the Vulnerable Software and Affected Versions: Local Deep Research versions 0.2.0 through 0.6.7 Description: Local Deep Research stores confidential information, including API keys, in a local SQLite database without encryption. This behavior was not clearly documented. Users were not giv...

CVE-2025-33084

IBM Concert Software 1.0.0 through 1.1.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...

CVE-2025-33082

IBM Concert Software 1.0.0 through 1.1.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2025-0656

IBM Concert Software 1.0.0–1.1.0 is affected by CVE-2025-0656: an unauthenticated attacker can inject arbitrary JavaScript into the Web UI via cross-site scripting, potentially exposing credentials in a trusted session. Root cause: insufficient input handling in the Web UI that allows script inje...

Malicious code in monolith-twirp-modelsgateway-telemetry (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 62052c32a08bc8af05a1012fc5a5e9b63a09eea906ff0affeeef77f4604b70ec The OpenSSF Package Analysis project identified 'monolith-twirp-modelsgateway-telemetry' @ 1.0.0 rubygems as malicious. It is considered malicio...

MAL-2025-46949 Malicious code in monolith-twirp-features-featuresync (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f53c57dca1a60f5e0bcea26028d79bc5d8f4427b2dfb2dc1c29c9babe625a2bb The OpenSSF Package Analysis project identified 'monolith-twirp-features-featuresync' @ 1.0.0 rubygems as malicious. It is considered malicious...

IBM Concert Software 加密问题漏洞

IBM Concert Software is an application lifecycle risk identification software from International Business Machines IBM. An encryption issue vulnerability exists in IBM Concert Software versions 1.0.0 through 1.1.0, which stems from a weak encryption algorithm that could lead to the decryption of...

IBM Concert Software 跨站脚本漏洞

IBM Concert Software is an application lifecycle risk identification software from International Business Machines IBM. A cross-site scripting vulnerability exists in IBM Concert Software versions 1.0.0 through 1.1.0 that stems from a cross-site scripting attack that could lead to credential...

IBM Concert Software 跨站脚本漏洞

IBM Concert Software is an application lifecycle risk identification software from International Business Machines IBM. A cross-site scripting vulnerability exists in IBM Concert Software versions 1.0.0 through 1.1.0 that stems from a cross-site scripting attack that could lead to credential...

CVE-2025-48307

Cross-Site Request Forgery CSRF vulnerability in kasonzhao SEO For Images seo-for-images allows Stored XSS.This issue affects SEO For Images: from n/a through = 1.0.0...

CVE-2025-48319

CVE-2025-48319 corresponds to a stored XSS in the WordPress plugin “Mesa Mesa Reservation Widget” (versions up to 1.0.0). The root cause is improper input neutralization during web page generation, enabling attacker-supplied payloads to persist in the widget. Reported as affecting Mesa Mesa Reser...

CVE-2025-48307 WordPress SEO For Images plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in kasonzhao SEO For Images seo-for-images allows Stored XSS.This issue affects SEO For Images: from n/a through = 1.0.0...

Malicious code in pp-react-grid (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 71193da54e6cdc258489d02db5987830a3bc147cbf9b43236f5757cab04f9c73 The OpenSSF Package Analysis project identified 'pp-react-grid' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2025-42129 Malicious code in pp-react-grid (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 71193da54e6cdc258489d02db5987830a3bc147cbf9b43236f5757cab04f9c73 The OpenSSF Package Analysis project identified 'pp-react-grid' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

WordPress plugin Mesa Mesa Reservation Widget 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2025-35007

Name of the Vulnerable Software and Affected Versions: Mesa Mesa Reservation Widget versions through 1.0.0 Description: The Mesa Mesa Reservation Widget contains a Stored Cross-site Scripting XSS issue due to improper neutralization of input during web page generation. Recommendations: Update Mes...

WordPress plugin SEO For Images 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

CVE-2025-57802

Airlink’s Daemon vulnerability (CVE-2025-57802) affects version 1.0.0, where an attacker with access to the affected container can create symbolic links inside the mounted /app/data directory. Because the container bind-mounts an arbitrary host path, these symlinks can point to sensitive host loc...