PT-2025-50146

Name of the Vulnerable Software and Affected Versions MailEnable versions prior to 10.54 Description The software contains a reflected cross-site scripting XSS issue in the Added parameter of the ''/Mondo/lang/sys/Forms/MAI/AddRecipientsResult.aspx'' endpoint. The Added value is not properly...

EUVD-2025-201664

A vulnerability was found in code-projects Currency Exchange System 1.0. This vulnerability affects unknown code of the file /edit.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used...

EUVD-2025-201372

The Featured Image via URL plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation function in all versions up to, and including, 0.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on...

CVE-2025-66401

MCP Watch is a comprehensive security scanner for Model Context Protocol MCP servers. In 0.1.2 and earlier, the MCPScanner class contains a critical Command Injection vulnerability in the cloneRepo method. The application passes the user-supplied githubUrl argument directly to a system shell via...

RLSA-2025:19345 Important: redis:7 security update

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, ...

Malicious code in @voiceflow/anthropic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5894ea8ba7ea0e9636e873dae07eb97fdcf83510f4e7a28b23f1d0b2e0a0afe0 The package @voiceflow/anthropic was found to contain malicious code. Source: google-open-source-security...

Malicious code in @voiceflow/voice-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79c5cf11d531645e24158300a51c4ed8ec4267e9b59051ff7f5266e5cdc593b6 The package @voiceflow/voice-types was found to contain malicious code. Source: ghsa-malware...

Malicious code in my-saeed-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d222a4cf76e8e0efb6de33ce203327546a24a125a7b6fa1e70bf04566d4d1dd The package my-saeed-lib was found to contain malicious code. Source: ghsa-malware c835d59a9317a70385922241ebb4aa8a34025c5cef3f3c22e03df1fc6f22042f A...

Malicious code in silgi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bab0537c840944fd6fac261deaaca0e3581745c3412d28b7ae3f0f014361c70 The package silgi was found to contain malicious code. Source: ghsa-malware 93a7af2f566e0384a306202ff261bb7cdc496fb32e582afda5808432c3ca4935 Any...

MAL-2025-191413 Malicious code in ra-auth-firebase (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ddebb70a73861543e5a68b94eb70a9b3e2fa3726a977ef776f8ef3fc75f0e76 The package ra-auth-firebase was found to contain malicious code. Source: ghsa-malware d4c20e629d2ccf83a4cc1a771392c0f879de71df77471d5e822fc511e415cb...

Malicious code in @micado-digital/stadtmarketing-kufstein-external (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b458f23284c11d0533df6f7d474554467329282fb52e761f0a654ef8cf69f3e The package @micado-digital/stadtmarketing-kufstein-external was found to contain malicious code. Source: ghsa-malware...

Malicious code in @jayeshsadhwani/telemetry-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 748dbf047a231765c722c6d71b1ab58a804ccccca31422aef069f8fc96f25753 The package @jayeshsadhwani/telemetry-sdk was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191444 Malicious code in unsearch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98d41465f8d935a520eb2c94bb174a649b13594010fc5348246aa22a055906c2 The package unsearch was found to contain malicious code. Source: ghsa-malware b55e1abf001e324d7e6020000bca3d6bd8c1c5843767dba793bc9256f02a44ef Any...

MAL-2025-191313 Malicious code in @silgi/ecosystem (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1476f1384de83c5e5ccae6b60fbcf5794fca7387b8904c42125a65fabab6051 The package @silgi/ecosystem was found to contain malicious code. Source: ghsa-malware e05b24c2b8b197e85ebbafbc2eef89e4b3c94f02b7519a3fe93b514a763e05...

MAL-2025-191059 Malicious code in @trigo/atrix-swagger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86c35c2f73646bcb572d5c9cc85d640fb8acdd21da4582946a069f92f2c146d7 The package @trigo/atrix-swagger was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191111 Malicious code in insomnia-plugin-random-pick (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8717488a1afc3be853313a0f8f243fa748188c0b321d8c9096182cf59bfbb1ed The package insomnia-plugin-random-pick was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191052 Malicious code in @relyt/mcp-server-relytone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2613b007d67d58acec7030d26a33c30562848bf77fb10a5e9194afbe95258426 The package @relyt/mcp-server-relytone was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191048 Malicious code in @pradhumngautam/common-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8984d278847eccce8a7e440093a12e26681f10e6534f163544592f20e7539c81 The package @pradhumngautam/common-app was found to contain malicious code. Source: ghsa-malware...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...