Sign in Get started free

loading

Every new threat · Live · InfraStack

Sign in Get started free

Live· 186 threats · Sunday, Oct 25· last check 2026-11-04 06:52 UTC

Everything we’re watching.

Every new vulnerability, vendor incident and attack on AI tools, merged from every source as it lands. Early warnings before a CVE exists.

On fire Needs attention Early warnings Everything

Sunday, Oct 25

Most severe in everything

Snipe-IT: Google SSO login skips the deactivated-user check

YesWiki: unauthenticated SQL injection in Bazar search reads password hashes

Parse Server: custom auth adapters skip checks, letting attackers log in

MALICIOUSDO NOT INSTALL

MALICIOUS · REMOVE IT

Malicious code in claudeopuseni (PyPI)claudeopuseni

Sunday, Oct 25

MALICIOUSDON'T INSTALLREMOVE ITMalicious code in claudeopuseni (PyPI)claudeopuseniPackage2026-10-25 23:43 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in claudeopusenifile (PyPI)claudeopusenifilePackage2026-10-25 23:40 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in claudeopusfile (PyPI)claudeopusfilePackage2026-10-25 23:35 UTCby osv-malicious–UNINSTALL MEDIUM5.3llama.cpp: malformed mmproj file causes out-of-bounds write locallyAI agents & MCP2026-10-25 23:17 UTCby EPSS–WHAT TO DO MEDIUM5.5smg: JPEG decoder allocates unbounded memory, letting remote requests exhaust server memoryAI agents & MCP2026-10-25 23:17 UTCby EPSS–WHAT TO DO MEDIUMINCIDENTTwilio: SMS Delivery Delays from Twilio to Telcel MexicoTwilioVendor2026-10-25 23:15 UTCby status page–WHAT TO DO HIGH7.5EyouCMS: remote_file_to_local lets attackers force server-side requestsOther2026-10-25 22:16 UTCby EPSS–WHAT TO DO MEDIUM6.0Elixir ash_postgres: skipped upserts can expose another tenant's rowPackage2026-10-25 18:01 UTCby EPSS–WHAT TO DO MEDIUM6.0Ash Postgres: multitenant lateral joins leak records across tenantsPackage2026-10-25 18:01 UTCby EPSS–WHAT TO DO MEDIUM6.0Ash: through-relationship loads leak unrelated destination records to clientsPackage2026-10-25 17:25 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in nebulallm (PyPI)nebulallmPackage2026-10-25 20:15 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in zagents-message-bus (PyPI)zagents-message-busPackage2026-10-25 19:14 UTCby osv-malicious–UNINSTALL MEDIUM5.8DedeCMS: vtime argument in update_guide.php allows remote code injectionPackage2026-10-25 18:16 UTCby EPSS–WHAT TO DO HIGH7.5SourceCodester Performance Indicator System: SQL injection via profile Contact fieldOther2026-10-25 18:16 UTCby EPSS–WHAT TO DO HIGH7.5SourceCodester Performance Indicator System: SQL injection via edit_dealer.php Contact fieldPerformance Indicator SystemOther2026-10-25 18:16 UTCby InfraStack Analyst–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @capsense/ccx-welcome-page (npm)@capsense/ccx-welcome-pagePackage2026-10-25 17:34 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @capsense/core-ui (npm)@capsense/core-uiPackage2026-10-25 17:28 UTCby osv-malicious–UNINSTALL HIGH7.5SourceCodester Performance Indicator System: SQL injection via adddealer.php Contact fieldOther2026-10-25 17:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDHTTP::Server::PSGI: one oversized Content-Length request crashes the Perl serverPackage2026-10-25 17:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDStarman: unbounded chunked request buffering lets one client exhaust memoryRuntime2026-10-25 17:17 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDStarman for Perl: HEAD responses carry bodies, desyncing keep-alive connectionsRuntime2026-10-25 17:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDStarman: crafted chunked request body exhausts CPU through regex backtrackingPackage2026-10-25 17:17 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDStarman: stalled request body holds every Perl worker, causing denial of servicePackage2026-10-25 17:17 UTCby EPSS–WHAT TO DO MEDIUM6.5Alfresco Activiti: JUEL script engine lets remote input inject codePackage2026-10-25 16:16 UTCby EPSS–WHAT TO DO MEDIUM6.5KodExplorer: online editor save endpoint allows unrestricted file uploadPackage2026-10-25 16:16 UTCby EPSS–WHAT TO DO MEDIUM6.5KodExplorer: Remote Download feature allows server-side request forgeryPackage2026-10-25 16:16 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in event-bus-lite-testmetest (npm)event-bus-lite-testmetestPackage2026-10-25 16:02 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in w-mousekey (npm)w-mousekeyPackage2026-10-25 15:51 UTCby osv-malicious–UNINSTALL MEDIUM6.5SourceCodester Performance Indicator System: SQL injection in product deletion pageOther2026-10-25 15:17 UTCby EPSS–WHAT TO DO LOW2.2SH3: weak password hashing in management and collection modulesOther2026-10-25 15:17 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in jshelperdependenceny (npm)jshelperdependencenyPackage2026-10-25 15:11 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @fmr-ap153177/apex-kit-icons (npm)@fmr-ap153177/apex-kit-iconsPackage2026-10-25 15:06 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @generic-means/ing-feat-scanner-libs (npm)@generic-means/ing-feat-scanner-libsPackage2026-10-25 15:05 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @factoryz/apollo (npm)@factoryz/apolloPackage2026-10-25 15:05 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @jm-telefonica/multibrand-components (npm)@jm-telefonica/multibrand-componentsPackage2026-10-25 15:05 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @postex/common (npm)@postex/commonPackage2026-10-25 15:05 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in sc-hydrate-carousel-price (npm)sc-hydrate-carousel-pricePackage2026-10-25 15:04 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @futurae-public/adaptive-js (npm)@futurae-public/adaptive-jsPackage2026-10-25 14:42 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in paychex-pdftron (npm)paychex-pdftronPackage2026-10-25 14:42 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @ppa-web-components/ppa-headerfooter (npm)@ppa-web-components/ppa-headerfooterPackage2026-10-25 14:28 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @ppa-web-components/ppa-hotel-collection (npm)@ppa-web-components/ppa-hotel-collectionPackage2026-10-25 14:26 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @ppa-web-components/ppa-banner (npm)@ppa-web-components/ppa-bannerPackage2026-10-25 14:25 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @ppa-web-components/ppa-builder (npm)@ppa-web-components/ppa-builderPackage2026-10-25 14:22 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @ppa-web-components/ppa-searchform (npm)@ppa-web-components/ppa-searchformPackage2026-10-25 14:21 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @ppa-web-components/ppa-navigation (npm)@ppa-web-components/ppa-navigationPackage2026-10-25 14:19 UTCby osv-malicious–UNINSTALL HIGH8.8YesWiki: unescaped Bazar field lets anonymous users dump password hashesOther2026-10-09 14:14 UTCby EPSS–WHAT TO DO HIGH8.1YesWiki: missing authorization lets rogue ActivityPub servers alter other actors' entriesPackage2026-10-09 14:15 UTCby EPSS–WHAT TO DO CRITICAL9.1YesWiki: unauthenticated SQL injection in Bazar search reads password hashesPackage2026-10-09 13:37 UTCby EPSS–WHAT TO DO MEDIUM6.4YesWiki: stored XSS in comments lets authenticated users run scriptsPackage2026-10-09 13:36 UTCby EPSS–WHAT TO DO MEDIUM6.9YesWiki: unauthenticated wiki syntax lets remote users reach internal hostsPackage2026-10-09 11:20 UTCby EPSS–WHAT TO DO HIGH8.1YesWiki: forged admin request deletes or restores pages via despam actionPackage2026-10-09 11:17 UTCby EPSS–WHAT TO DO MEDIUM6.1YesWiki: unencoded filtertags output lets anonymous users inject stored scriptsPackage2026-10-09 11:15 UTCby EPSS–WHAT TO DO MEDIUM5.4YesWiki: stored XSS via unsanitized SVG uploads in bazar image fieldPackage2026-10-09 11:14 UTCby EPSS–WHAT TO DO HIGH8.8Snipe-IT: concurrent SAML assertion replay yields multiple victim sessionsPackage2026-10-08 15:30 UTCby EPSS–WHAT TO DO HIGH8.2Snipe-IT: LDAP StartTLS failure silently falls back to cleartext bindsPackage2026-10-08 15:30 UTCby EPSS–WHAT TO DO CRITICAL9.2Snipe-IT: Google SSO login skips the deactivated-user checkPackage2026-10-08 15:30 UTCby EPSS–WHAT TO DO MEDIUM5.3Snipe-IT: API asset creation stores encrypted custom fields as plaintextPackage2026-10-08 15:30 UTCby EPSS–WHAT TO DO LOW2.6Contrast: registry selection can send wildcard credentials to concrete registriesInfrastructure2026-10-08 13:01 UTCby EPSS–WHAT TO DO MEDIUM6.0Rclone: B2 backend leaks account token and SSE-C keys on redirectsPackage2026-10-09 10:55 UTCby EPSS–WHAT TO DO HIGH7.0Rclone: path traversal lets synced files change parent directory metadataOther2026-10-09 10:55 UTCby EPSS–WHAT TO DO HIGH7.6Rclone: pCloud OAuth callback CSRF lets web pages plant attacker tokensPackage2026-10-09 10:55 UTCby EPSS–WHAT TO DO MEDIUM6.9Rclone: WebDAV server skips authentication on OPTIONS requestsPackage2026-10-09 10:55 UTCby EPSS–WHAT TO DO HIGH8.2rclone: unauthenticated SSRF via --rc-serve redirects requests and leaks headersPackage2026-10-09 10:55 UTCby EPSS–WHAT TO DO HIGH8.7PUBLIC EXPLOITRclone: WebDAV path traversal lets unauthenticated users write outside served rootPackage2026-10-09 10:55 UTCby EPSS–WHAT TO DO MEDIUM6.3rclone: WebDAV backend leaks custom auth headers across redirectsPackage2026-10-09 10:56 UTCby EPSS–WHAT TO DO HIGH7.7rclone: self-update trusts unsigned checksums, installing attacker-supplied binariesPackage2026-10-09 10:56 UTCby EPSS–WHAT TO DO MEDIUM6.9rclone: integer overflow in S3 multipart upload lets attackers exhaust memoryPackage2026-10-09 10:55 UTCby EPSS–WHAT TO DO MEDIUM6.1Rclone: S3 auth proxy lets tenants touch other tenants' multipart uploadsPackage2026-10-09 10:55 UTCby EPSS–WHAT TO DO LOW2.3OpenRemote: gateway events can alter or delete assets in other realmsRuntime2026-10-08 12:32 UTCby EPSS–WHAT TO DO MEDIUM5.3OpenRemote core: authenticated users can read other realms' gateway tunnel dataOther2026-10-08 12:33 UTCby EPSS–WHAT TO DO LOW2.1OpenRemote: realm admins can impersonate gateways in other realmsInfrastructure2026-10-08 12:31 UTCby EPSS–WHAT TO DO HIGH8.7phpMyFAQ: unauthenticated users can modify or delete visitor questionsPackage2026-10-10 05:25 UTCby EPSS–WHAT TO DO MEDIUM5.3phpMyFAQ: PDF export fetches internal URLs from FAQ imagesPackage2026-10-10 05:10 UTCby EPSS–WHAT TO DO HIGH7.1vLLM: out-of-vocabulary stop_token_ids crash the engine remotelyAI agents & MCP2026-10-09 08:27 UTCby EPSS–WHAT TO DO HIGH8.3vLLM: crafted prompt_logprobs request crashes the engine and drops all requestsAI agents & MCP2026-10-09 06:39 UTCby EPSS–WHAT TO DO HIGH8.7vLLM: API clients can bypass frame cap and exhaust memoryAI agents & MCP2026-10-09 08:24 UTCby EPSS–WHAT TO DO HIGH8.2vLLM: crafted multimodal requests crash the inference engine remotelyAI agents & MCP2026-10-09 08:21 UTCby EPSS–WHAT TO DO HIGH8.7vLLM: crafted image triggers memory exhaustion, denying service to other usersAI agents & MCP2026-10-09 08:12 UTCby EPSS–WHAT TO DO HIGH8.8vLLM: X-Request-Id header lets API callers force outbound connectionsAI agents & MCP2026-10-09 07:58 UTCby EPSS–WHAT TO DO HIGH7.1vLLM: small compressed audio expands into memory-exhausting decoded PCMAI agents & MCP2026-10-09 07:55 UTCby EPSS–WHAT TO DO HIGH8.2vLLM: out-of-vocabulary token IDs crash the engine over gRPCAI agents & MCP2026-10-09 07:49 UTCby EPSS–WHAT TO DO HIGH8.2vLLM: oversized logprob requests over gRPC crash the inference engineAI agents & MCP2026-10-09 07:47 UTCby EPSS–WHAT TO DO HIGH8.2vLLM: oversized top_n in gRPC requests crashes the inference engineAI agents & MCP2026-10-09 07:47 UTCby EPSS–WHAT TO DO HIGH8.7SiYuan on Windows: path check bypass exposes API token and TLS keysPackage2026-10-09 11:26 UTCby EPSS–WHAT TO DO MEDIUM6.9SiYuan: SQL injection lets admin-token holders read deleted document historyPackage2026-10-09 11:51 UTCby EPSS–WHAT TO DO MEDIUM5.4SiYuan: stored XSS in math blocks runs script on link clickPackage2026-10-09 11:59 UTCby EPSS–WHAT TO DO MEDIUM6.9SiYuan: MCP asset upload lets authenticated users copy secret filesPackage2026-10-09 12:35 UTCby EPSS–WHAT TO DO HIGH7.6SiYuan: unauthenticated /check-auth page runs javascript links, reads workspacePackage2026-10-09 12:47 UTCby EPSS–WHAT TO DO HIGH7.6SiYuan: TLS-only setting ignored, kernel API served over plain HTTPPackage2026-10-09 13:14 UTCby EPSS–WHAT TO DO HIGH8.8PUBLIC EXPLOITParse Server: unauthenticated clients can delete class schemas on MongoDBPackage2026-10-08 23:07 UTCby EPSS–WHAT TO DO MEDIUM6.3Parse Server: client writes to reserved internal fields break reads and lockoutsPackage2026-10-08 19:28 UTCby EPSS–WHAT TO DO CRITICAL9.1Parse Server: custom auth adapters skip checks, letting attackers log inPackage2026-10-10 02:04 UTCby EPSS–WHAT TO DO LOW2.1Parse Server: SMS MFA login request saves fields with master privilegesPackage2026-10-11 11:24 UTCby EPSS–WHAT TO DO MEDIUM6.0Parse Server: LiveQuery subscriptions with $or leak other users' eventsPackage2026-10-10 21:08 UTCby EPSS–WHAT TO DO MEDIUM4.8ImageMagick: crafted image overflows heap in X11 animate, can crashPackage2026-10-10 13:52 UTCby EPSS–WHAT TO DO MEDIUM4.8ImageMagick: -cdl option leaks memory, exhausting server resources over timePackage2026-10-10 13:52 UTCby EPSS–WHAT TO DO LOW2.5ImageMagick: failed compare operations leak memory, enabling denial of servicePackage2026-10-10 13:52 UTCby EPSS–WHAT TO DO MEDIUM4.8ImageMagick PerlMagick: memory leak in image property reads enables denial of servicePackage2026-10-10 13:53 UTCby EPSS–WHAT TO DO MEDIUM4.8ImageMagick: missing cleanup in -set profile option leaks memoryPackage2026-10-10 13:54 UTCby EPSS–WHAT TO DO MEDIUM6.9ImageMagick: crafted XMP profiles leak memory and exhaust server resources1 talkingPackage2026-10-10 13:54 UTCby EPSS1talkingWHAT TO DO MEDIUM6.9ImageMagick: XML nesting-limit path leaks memory, enabling denial of servicePackage2026-10-10 13:56 UTCby EPSS–WHAT TO DO LOW2.5ImageMagick: heap overflow on 32-bit systems via crafted convex-hull imagesPackage2026-10-10 13:56 UTCby EPSS–WHAT TO DO MEDIUM6.9ImageMagick: crafted MAT files leak memory in the decoderPackage2026-10-10 13:57 UTCby EPSS–WHAT TO DO MEDIUM6.3ImageMagick: crafted images leak memory in the JNG encoderPackage2026-10-10 13:57 UTCby EPSS–WHAT TO DO LOW3.1ImageMagick: FPX encoder memory leak lets crafted images exhaust server memoryPackage2026-10-10 13:58 UTCby EPSS–WHAT TO DO HIGH8.1ImageMagick: stack overflow in bzip2 image decoding corrupts memoryPackage2026-10-10 14:00 UTCby EPSS–WHAT TO DO MEDIUM4.8ImageMagick: drawing options injected into MVG output filesPackage2026-10-10 14:00 UTCby EPSS–WHAT TO DO MEDIUM6.3ImageMagick: DJVU decoder crashes on failed allocation, enabling denial of servicePackage2026-10-10 14:00 UTCby EPSS–WHAT TO DO MEDIUM6.3ImageMagick: crafted MSL file leaks memory and exhausts server resourcesPackage2026-10-10 14:01 UTCby EPSS–WHAT TO DO LOW3.9ImageMagick: incomplete fix lets crafted input bypass security policyPackage2026-10-10 14:01 UTCby EPSS–WHAT TO DO MEDIUM4.8ImageMagick: crafted MVG file crashes the process through stack exhaustionPackage2026-10-10 14:02 UTCby EPSS–WHAT TO DO MEDIUM4.8ImageMagick: PS, PDF and XPS decoders bypass scene-count policy limitPackage2026-10-10 14:02 UTCby EPSS–WHAT TO DO MEDIUM4.8ImageMagick: crafted image leaks adjacent heap memory during bounding-box outputPackage2026-10-10 14:02 UTCby EPSS–WHAT TO DO MEDIUM6.9ImageMagick: UHDR decoder skips width and height policy limits before decodingPackage2026-10-10 14:02 UTCby EPSS–WHAT TO DO MEDIUM4.8ImageMagick: delegate parsing lets a policy-blocked program still runPackage2026-10-10 14:03 UTCby EPSS–WHAT TO DO MEDIUM5.4WWBN AVideo: stored XSS in comments runs script in viewers' browsersPackage2026-10-08 12:51 UTCby EPSS–WHAT TO DO MEDIUM5.3mycli: whitelist check in source command allows OS command injection locallyPackage2026-10-25 14:16 UTCby EPSS–WHAT TO DO MEDIUM5.3LinkStack: cross-site request forgery in an unknown function up to 4.8.8Package2026-10-25 13:16 UTCby EPSS–WHAT TO DO MEDIUMINCIDENTTwilio: SMS Delivery Delays and Failures from Twilio to Claro BrazilTwilioVendor2026-10-25 12:47 UTCby status page–WHAT TO DO MEDIUM6.3adm-zip: duplicate-entry check bypass lets crafted ZIPs overwrite validated filesPackage2026-10-25 12:16 UTCby EPSS–WHAT TO DO MEDIUM6.0ProjectSend: staff can share protected files through version linkingPackage2026-10-25 12:16 UTCby EPSS–WHAT TO DO MEDIUM6.9Leon: model download path traversal lets a URL write files outside models directoryAI agents & MCP2026-10-25 12:16 UTCby EPSS–WHAT TO DO MEDIUM5.4Infinity for Reddit: hardcoded OAuth state lets attackers log victims into their accountPackage2026-10-25 12:16 UTCby EPSS–WHAT TO DO HIGH8.2rotki: weak unsalted key derivation lets attackers crack premium backupsPackage2026-10-25 12:16 UTCby EPSS–WHAT TO DO MEDIUM6.9Docker-Proxy hubcmdui: unauthenticated config read and overwrite via /api/configOther2026-10-25 12:16 UTCby EPSS–WHAT TO DO MEDIUM6.9NiubiGEO: unauthenticated SSRF via POST /audit-plan reads internal responsesOther2026-10-25 12:16 UTCby EPSS–WHAT TO DO HIGH8.8Dokploy: organization admins can control other tenants' applicationsPackage2026-10-25 12:16 UTCby EPSS–WHAT TO DO HIGH8.8Paisa: path traversal lets unauthenticated attackers read server filesPackage2026-10-25 12:16 UTCby EPSS–WHAT TO DO HIGH7.0Firecrawl: DNS rebinding lets scrape requests reach internal hostsAI agents & MCP2026-10-25 12:16 UTCby EPSS–WHAT TO DO MEDIUMINCIDENTTwilio: SMS Delivery Delays from Twilio to Telia SwedenTwilioVendor2026-10-25 12:12 UTCby status page–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in fontus (PyPI)fontusPackage2026-10-25 10:58 UTCby osv-malicious–UNINSTALL MEDIUMINCIDENTFly.io: MPGv2 IAD control plane is read-onlyFly.ioVendor2026-10-25 10:46 UTCby status page–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in insta-api-wrapper (npm)insta-api-wrapperPackage2026-10-25 09:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in ionic-sound-cloud-loader-api (npm)ionic-sound-cloud-loader-apiPackage2026-10-25 09:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in insta-reel-search (npm)insta-reel-searchPackage2026-10-25 09:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in sound-cloud-loader-api (npm)sound-cloud-loader-apiPackage2026-10-25 09:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in tiktok-video-scraper (npm)tiktok-video-scraperPackage2026-10-25 09:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in ionic-tiktok-scraper (npm)ionic-tiktok-scraperPackage2026-10-25 09:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in youtube-search-without-api-key (npm)youtube-search-without-api-keyPackage2026-10-25 09:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in ocsp-hashes (npm)ocsp-hashesPackage2026-10-25 09:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in redis-dumper (npm)redis-dumperPackage2026-10-25 09:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in ionic-youtube-streams (npm)ionic-youtube-streamsPackage2026-10-25 09:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in youtube-info-streams (npm)youtube-info-streamsPackage2026-10-25 09:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in ionic-insta-search (npm)ionic-insta-searchPackage2026-10-25 09:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in appit-cordova-admob (npm)appit-cordova-admobPackage2026-10-25 09:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in appit-cordova-plugin-ionic (npm)appit-cordova-plugin-ionicPackage2026-10-25 09:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in ionic-youtube-search (npm)ionic-youtube-searchPackage2026-10-25 09:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in cordova-plugin-geofence-appit (npm)cordova-plugin-geofence-appitPackage2026-10-25 09:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in p12-pem (npm)p12-pemPackage2026-10-25 09:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in cert-infos (npm)cert-infosPackage2026-10-25 09:35 UTCby osv-malicious–UNINSTALL HIGH7.5Employee Recruitment System: SQL injection in registration form lets attackers query databasePackage2026-10-25 09:16 UTCby EPSS–WHAT TO DO HIGH7.5EmployeeRecruitmentSystem: SQL injection in registration form lets remote users query the databasePackage2026-10-25 09:16 UTCby EPSS–WHAT TO DO MEDIUMINCIDENTTwilio: SMS Delivery Delays from Twilio to Airtel NigeriaTwilioVendor2026-10-25 09:11 UTCby status page–WHAT TO DO HIGHINCIDENTAnthropic: Elevated errors for Claude Fable 5.1AnthropicVendor2026-10-25 08:17 UTCby status page–WHAT TO DO HIGH7.5EmployeeRecruitmentSystem: registration form SQL injection allows remote database accessEmployeeRecruitmentSystemPackage2026-10-25 08:16 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.0Vocechat: welcome query parameter in widget.html enables cross-site scriptingPackage2026-10-25 08:16 UTCby EPSS–WHAT TO DO MEDIUM5.3EventCatalog SDK: path traversal in custom docs helpers lets callers write outside intended directoryPackage2026-10-25 07:16 UTCby EPSS–WHAT TO DO MEDIUM4.3designer-mcp: path traversal in get_reference lets remote callers read filesAI agents & MCP2026-10-25 07:16 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @eforms/forms-api (npm)@eforms/forms-apiPackage2026-10-25 06:26 UTCby osv-malicious–UNINSTALL HIGHNOT SCOREDWooCommerce Google Pay plugin lets anyone mark orders as paidPackage2026-10-25 06:16 UTCby EPSS–WHAT TO DO MEDIUM6.5TinyFileManager: remote URL upload lets attackers upload arbitrary filesPackage2026-10-25 06:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDDuplicator WordPress plugin: upgrade routine lets attackers run PHPPackage2026-10-25 06:16 UTCby EPSS–WHAT TO DO CRITICALNOT SCOREDDatawiza Proxy Auth WordPress plugin: forged headers grant administrator loginPackage2026-10-25 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDQi Addons For Elementor: contributors can inject phishing forms into postsPackage2026-10-25 06:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDInstaWP Connect WordPress plugin: missing capability check lets low roles change settingsPackage2026-10-25 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDWPVR WordPress plugin lets contributors edit other users' virtual toursPackage2026-10-25 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDWPVR WordPress plugin lets contributors read and edit other users' toursPackage2026-10-25 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDWPVR WordPress plugin: contributors can publish tours and set arbitrary post metadataPackage2026-10-25 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDGiveWP WordPress plugin lets report-only users edit donor addressesPackage2026-10-25 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDGiveWP WordPress plugin lets fundraising role edit other users' pagesPackage2026-10-25 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDGiveWP WordPress plugin: donation form setting enables stored script injectionPackage2026-10-25 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDGiveWP WordPress plugin: path traversal reads and overwrites server filesPackage2026-10-25 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDGiveWP WordPress plugin exposes unpublished donation forms to anonymous visitorsPackage2026-10-25 06:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDWP Stripe Checkout WordPress plugin: forged webhooks create unpaid completed ordersPackage2026-10-25 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDContact Form by Supsystic WordPress plugin: stored script injection via form namePackage2026-10-25 06:16 UTCby EPSS–WHAT TO DO HIGHINCIDENTAnthropic: Elevated errors for multiple modelsAnthropicVendor2026-10-25 06:14 UTCby status page–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @drone-js-ext/core (npm)@drone-js-ext/corePackage2026-10-25 04:49 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @drone-js-ext/vip-badge (npm)@drone-js-ext/vip-badgePackage2026-10-25 04:47 UTCby osv-malicious–UNINSTALL LOW3.7ruoyi-vue-pro: SMS login code check lacks limit on guess attemptsPackage2026-10-25 04:17 UTCby EPSS–WHAT TO DO HIGH7.5ruoyi-vue-pro: SMS code check in AuthController can be bypassed remotelyPackage2026-10-25 04:17 UTCby EPSS–WHAT TO DO MEDIUM4.0PUBLIC EXPLOITOnyx: cross-site scripting in craft output preview tabonyxAI agents & MCP2026-10-25 03:16 UTCby InfraStack Analyst–WHAT TO DO HIGH7.5PUBLIC EXPLOITPrivateGPT: URI loader lets remote users trigger server-side request forgeryAI agents & MCP2026-10-25 03:16 UTCby EPSS–WHAT TO DO HIGH7.5Restaurant_IMS: SQL injection in lsmodal.php login_id lets attackers query the databaseRestaurant_IMSOther2026-10-25 02:16 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.5pig-mesh pig: SQL injection through ascs/descs sort argumentsPackage2026-10-25 00:16 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in tailwind-base-buttons (npm)tailwind-base-buttonsPackage2026-10-25 00:05 UTCby osv-malicious–UNINSTALL HIGHTECHNIQUETailwormUnpatched Tailscale SSH flaws (Tailworm) let one compromised device get root on other servers in the tailnetTailscale5 talkingInfrastructure2026-10-25by InfraStack Analyst5talkingWHAT TO DO

Saturday, Oct 24Sunday, Oct 25Monday, Oct 26