Linux Distros Unpatched Vulnerability : CVE-2025-21176

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability CVE-2025-21176 Note that Nessus relies on the presence of the package as reported by...

Linux Distros Unpatched Vulnerability : CVE-2024-35264

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - .NET and Visual Studio Remote Code Execution Vulnerability CVE-2024-35264 Note that Nessus relies on the presence of the package as reported by the vendor...

Linux Distros Unpatched Vulnerability : CVE-2024-38081

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability CVE-2024-38081 Note that Nessus relies on the presence of the package as reported b...

Attackers Abuse Velociraptor Forensic Tool to Deploy Visual Studio Code for C2 Tunneling

Cybersecurity researchers have called attention to a cyber attack in which unknown threat actors deployed an open-source endpoint monitoring and digital forensic tool called Velociraptor, illustrating ongoing abuse of legitimate software for malicious purposes. "In this incident, the threat actor...

Attackers Abuse Velociraptor Forensic Tool to Deploy Visual Studio Code for C2 Tunneling

Cybersecurity researchers have called attention to a cyber attack in which unknown threat actors deployed an open-source endpoint monitoring and digital forensic tool called Velociraptor, illustrating ongoing abuse of legitimate software for malicious purposes. "In this incident, the threat actor...

CVE-2025-58062

LSTM-Kirigaya's openmcp-client is a vscode plugin for mcp developer. Prior to version 0.1.12, when users on a Windows platform connect to an attacker controlled MCP server, attackers could provision a malicious authorization server endpoint to silently achieve an OS command injection attack in th...

Researchers Find VS Code Flaw Allowing Attackers to Republish Deleted Extensions Under Same Names

Cybersecurity researchers have discovered a loophole in the Visual Studio Code Marketplace that allows threat actors to reuse names of previously removed extensions. Software supply chain security outfit ReversingLabs said it made the discovery after it identified a malicious extension named...

Safeguarding VS Code against prompt injections

The Copilot Chat extension for VS Code has been evolving rapidly over the past few months, adding a wide range of new features. Its new agent mode lets you use multiple large language models LLMs, built-in tools, and MCP servers to write code, make commit requests, and integrate with external...

CVE-2025-49424

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in themepassion Support Ticket support-ticket allows Reflected XSS.This issue affects Support Ticket: from n/a through = 1.9...

CVE-2025-53299

Deserialization of Untrusted Data vulnerability in ThemeMakers ThemeMakers Visual Content Composer tmmcontentcomposer allows Object Injection.This issue affects ThemeMakers Visual Content Composer: from n/a through = 1.5.8...

Microsoft Visual Studio Code Execution

The vulnerability of the Microsoft Visual Studio software development tool is related to insufficient testing of arguments passed in commands. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

CVE-2025-46269

In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing VC6 files. This could lead to a heap-based buffer overflow. An attacker could leverage this vulnerability to execut...

CVE-2025-53299

Deserialization of Untrusted Data vulnerability in ThemeMakers ThemeMakers Visual Content Composer tmmcontentcomposer allows Object Injection.This issue affects ThemeMakers Visual Content Composer: from n/a through = 1.5.8...

CVE-2025-49424

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in themepassion Support Ticket support-ticket allows Reflected XSS.This issue affects Support Ticket: from n/a through = 1.9...

CVE-2025-49424 WordPress Support Ticket Plugin <= 1.9 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in themepassion Support Ticket support-ticket allows Reflected XSS.This issue affects Support Ticket: from n/a through = 1.9...

CVE-2025-49424 WordPress Essential Doo Components for Visual Composer plugin <= 1.9 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in diego.benna Essential Doo Components for Visual Composer allows DOM-Based XSS. This issue affects Essential Doo Components for Visual Composer: from n/a through 1.9...

CVE-2025-53299 WordPress ThemeMakers Visual Content Composer Plugin <= 1.5.8 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in ThemeMakers ThemeMakers Visual Content Composer tmmcontentcomposer allows Object Injection.This issue affects ThemeMakers Visual Content Composer: from n/a through = 1.5.8...

CVE-2025-53299

CVE-2025-53299 describes a deserialization of untrusted data vulnerability in ThemeMakers Visual Content Composer (WordPress plugin) that enables PHP object injection. Affected versions are up to 1.5.8 (inclusive); the root cause is deserializing untrusted data, which can lead to object injection...

CVE-2025-53299 WordPress ThemeMakers Visual Content Composer Plugin <= 1.5.8 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in ThemeMakers ThemeMakers Visual Content Composer tmmcontentcomposer allows Object Injection.This issue affects ThemeMakers Visual Content Composer: from n/a through = 1.5.8...

WordPress plugin Essential Doo Components for Visual Composer 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A security vulnerability exists in WordPress plugin...