Malicious code in pnpm_lockfile_file_v8 (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-47714 Malicious code in pnpm_lockfile_file_v8 (npm)

--- -= Per source details. Do not edit below this line.=-...

PT-2025-39673

Name of the Vulnerable Software and Affected Versions Notepad++ versions 8.8.3 and earlier Description Notepad++ version 8.8.3 contains a DLL hijacking flaw. This allows an attacker to replace original DLL files, such as NppExport.dll, with malicious versions, leading to arbitrary code execution...

CVE-2025-9798 Stored XSS in Netcad Software's Netigma

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Netcad Software Inc. Netigma allows Stored XSS. This issue affects Netigma: from 6.3.3 before 6.3.5 V8...

SUSE CVE-2025-59431

MapServer is a system for developing web-based GIS applications. Prior to 8.4.1, the XML Filter Query directive PropertyName is vulnerably to Boolean-based SQL injection. It seems like expression checking is bypassed by introducing double quote characters in the PropertyName. Allowing to manipula...

CVE-2025-59588

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in PenciDesign Soledad soledad allows PHP Local File Inclusion.This issue affects Soledad: from n/a through = 8.6.8...

CVE-2025-59588

CVE-2025-59588 describes an authenticated Local File Inclusion in the Soledad WordPress theme (Soledad

WordPress Soledad Theme <= 8.6.8 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Soledad versions = 8.6.8...

PT-2025-39059

Name of the Vulnerable Software and Affected Versions PenciDesign Soledad versions through 8.6.8 Description A flaw exists in PenciDesign Soledad that allows for DOM-Based Cross-site Scripting XSS. This issue is due to improper neutralization of input during web page generation. The vulnerability...

WordPress Soledad Theme <= 8.6.8 is vulnerable to Cross Site Scripting (XSS)

Software Soledad Type Theme Vulnerable versions = 8.6.8 Fixed in 8.6.9 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-59589 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 129327b97bb0 Credits João Pedro S Alcântara Kinorth Required privile...

CVE-2025-59713

Snipe-IT before 8.1.18 allows unsafe deserialization...

UBUNTU-CVE-2025-59431

MapServer is a system for developing web-based GIS applications. Prior to 8.4.1, the XML Filter Query directive PropertyName is vulnerably to Boolean-based SQL injection. It seems like expression checking is bypassed by introducing double quote characters in the PropertyName. Allowing to manipula...

BIT-MONGODB-2025-10060 MongoDB may be susceptible to Invariant Failure in Transactions due Upsert Operation

MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and server crash during commit. This issue may be triggered by improper WriteUnitOfWork state management. This issue affects MongoDB Server v6.0...

SUSE-SU-2025:03268-1 Security update for curl

This update for curl fixes the following issues: Security issues fixed: - CVE-2025-9086: bug in patch comparison logic when processing cookies can lead to out-of-bounds read in heap buffer bsc1249191. - CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious serv...

Suricata IDPE 8.0.1

Suricata is a network intrusion detection and prevention engine developed by the Open Information Security Foundation and its supporting vendors. The engine is multi-threaded and has native IPv6 support. It's capable of loading existing Snort rules and signatures and supports the Barnyard and...

GO-2025-3960 Mattermost Open Redirect vulnerability in github.com/mattermost/mattermost-server

Mattermost Open Redirect vulnerability in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...

mysql: Replication unspecified vulnerability (CPU Jul 2025)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Replication. Supported versions that are affected are 8.0.0-8.0.42. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attac...

MongoDB 6.0.x < 6.0.24 / 7.0.x < 7.0.18 / 8.0.x < 8.0.6 (SERVER-100901)

The version of MongoDB installed on the remote host is 6.0 prior to 6.0.24, 7.0 prior to 7.0.18, and 8.0 prior to 8.0.6. It is, therefore, affected by a vulnerability as referenced in the SERVER-100901 advisory. - An improper setting of the lsid field on any sharded query can cause a crash in...

Type Confusion

Overview Affected versions of this package are vulnerable to Type Confusion in v8. This vulnerability has been reported exploited in the wild. Remediation Upgrade chromium to version 140.0.7339.185 or higher. References - Chrome Releases - CISA - Known Exploited Vulnerabilities...

CVE-2025-5005

CVE-2025-5005 affects Lingdang CRM up to 8.6.5.4. The vulnerability is a server-side request forgery (SSRF) in an unknown function of the file crm/WeiXinApp/dingtalk/index_event.php, caused by manipulation of the corpurl argument. Reports indicate the attack can be launched remotely and that the ...