Exploited vulnerabilities and malicious packages from CISA KEV, EPSS and OSV, merged into one feed. Checked every 10 minutes. Not every CVE: only the ones with proof of attacks or malware.
Malicious code was published inside the npm package nulio-connector, so installing it can run attacker-controlled code on a developer's or build system. npm package nulio-connector, versions 1.1.16 and 1.1.10. Remove these versions now, pin to a known-safe release, and check systems that installed them for signs of compromise.
The npm package contains malicious code that can run on a developer's machine and may let an attacker take over the system or steal data. The npm package @atedone/workspace-context, including versions 0.0.14 through 0.0.25 such as 0.0.15, 0.0.20, 0.0.22, 0.0.23, and 0.0.25. Remove the package from projects, pin away from these versions, and check for signs of compromise such as unexpected processes or credential changes.
Attackers compromised this npm package and inserted malicious code, which can run on a developer's machine when the package is installed or used. npm package agentic-awesome-skills, including versions 18.9.0 through 19.9.0 and other listed releases. Remove the affected agentic-awesome-skills versions now, switch to a known clean release, and check for signs of compromise such as unexpected processes, new scripts, or credential theft.
Malicious code was published inside this npm package, so anyone who installs it can have their system run attacker-controlled code. npm package opencode-skills-collection, including versions 4.1.10, 4.0.57, 4.1.11, 4.1.16, 4.1.13, 4.1.6, and about 23 other versions. Remove opencode-skills-collection from all projects, pin away from every listed version, and check for signs of compromise on any system that installed it.
Malicious code was published inside this npm package, so installing it can let attackers run harmful code on the machine that installs it. npm package dsh-moss-console, version 3.3.0. Remove or downgrade dsh-moss-console 3.3.0 now, and check systems that installed it for signs of compromise.
Attackers planted malicious code in the npm package blitzstrike, which can run harmful commands on any machine that installs it. npm package blitzstrike, version 2.4.180. Remove blitzstrike 2.4.180 from your projects now, check installed systems for signs of compromise, and rotate any credentials they could reach.
Attackers planted malicious code in this npm package, so installing it can run harmful code on your machine and compromise the systems it touches. npm package @lynnidoffc/baileys, all versions. Remove this package from your projects now, avoid installing it, and check for signs of compromise on any system where it was installed.
Attackers can exploit a timing flaw during WordPress core upgrades to run code on the server without logging in, and this is being actively exploited in the wild. WordPress core. Apply the vendor's update now and check for signs of compromise.
A remote attacker with a valid login can upload files with content they choose to a predictable spot on the disk, and attackers are actively exploiting this flaw. It can also be chained with two other flaws. Ivanti Connect Secure. Apply the vendor's update now and check for signs of compromise, such as unexpected uploaded files on the appliance.
An attacker who already has a login on Ivanti Connect Secure can skip a required check and gain higher privileges, and this flaw is being actively exploited. Ivanti Connect Secure. Apply the vendor's update now and check for signs of compromise.
An unauthenticated attacker can run arbitrary code on the GitLab server using a specially crafted regular expression in a CI/CD configuration; this flaw is being actively exploited. GitLab Community Edition and Enterprise Edition. Apply the vendor's update now and check for signs of compromise.
An unauthenticated remote attacker can crash the device by sending crafted traffic, causing it to reload unexpectedly and drop service; this flaw is being exploited in the wild. Cisco Secure Firewall ASA Software and Cisco Secure FTD Software. Apply the vendor's update now and check for signs of compromise.
An attacker who already has admin access can carry out certain actions on the system without leaving a log entry, and this flaw is being actively exploited. Broadcom VMware ESX. Apply the vendor's mitigations or update now, and check for signs of compromise.
Attackers can modify data cached in memory for files on the system, and chained with other flaws they can plant PHP webshells and run commands as root. Linux Kernel. Apply the vendor's update now and check for signs of compromise, such as unexpected PHP files or unknown root processes.
Attackers can upload dangerous file types to the store and run their own code, potentially taking over accounts or sessions. This flaw is being actively exploited. Adobe Commerce and Magento. Apply the vendor's update now and check for signs of compromise, such as unexpected uploaded files or unfamiliar admin activity.
A remote attacker can send a specially crafted Brotli-compressed stream to corrupt memory, read sensitive memory contents, crash the program, or possibly run arbitrary code, and this flaw is being actively exploited. PyPI packages brotli (versions 1.0.3 up to 1.2.1) and brotlicffi (versions 1.0.3 up to 1.2.1.0). Upgrade brotli to 1.2.1 and brotlicffi to 1.2.1.0 now, and check for signs of compromise.
Attackers can run their own code on the server without logging in, due to a memory bug in PHP, and this flaw is being actively exploited. PHP Group PHP. Apply the vendor's update now and check for signs of compromise.
An unauthenticated remote attacker can run arbitrary code on servers due to a stale request-state flaw, and this vulnerability is being actively exploited. PHP Group PHP. Apply the vendor's update now and check for signs of compromise.
Attackers can send specially crafted database queries to reach privileged internal functions and affect the orchestrator host, and this flaw is being actively exploited. Arista VeloCloud Orchestrator on-prem. Apply the vendor's mitigations or update now, and check for signs of compromise.
Attackers can run their own commands on the server remotely, because a flaw lets crafted input be passed to the operating system, and this is being actively exploited. Collabora Online built-in CODE Server, when used within the NextCloud platform. Apply the vendor's update now and check for signs of compromise.
Attackers have published malicious code inside this package, which can run harmful commands on any machine that installs it and may steal secrets or credentials. The npm package tensorlake, version 0.5.144. Remove or downgrade tensorlake 0.5.144 now, rotate any credentials on affected machines, and check for signs of compromise.
The npm package contains malicious code that can run on a developer's machine or build system once installed, potentially letting an attacker take control or steal data. npm package @tallyui/components, versions 1.0.1, 1.0.2 and 1.0.3. Remove these versions from your projects, pin to a known-safe release, and check for signs of compromise on any system that installed them.
Attackers can run arbitrary operating system commands with root or SYSTEM privileges on the server, and this flaw is being actively exploited. EG Secure Solutions SiteGuard Server Edition. Apply the vendor's update now and check for signs of compromise.
An attacker who already has admin access can write arbitrary files to the server, and those files may run when loaded, letting them take control. This flaw is being exploited in the wild and can be chained with other flaws. Plex Media Server. Apply the vendor's update now and check for signs of compromise.
An authenticated user can make the server send requests to internal or external addresses of their choosing, which is being actively exploited in attacks and can be chained with other flaws. Plex Media Server. Apply the vendor's update now and check for signs of compromise.
An attacker can exploit a web page flaw in Plex Media Server to call other plugin functions and supply their own inputs, and this is being actively exploited in the wild. Plex Media Server. Apply the vendor's update now and check for signs of compromise.
An attacker with any valid-looking access token can make the Plex server send POST requests to a destination of their choosing, and this flaw is being actively exploited. Plex Media Server. Apply the vendor's update now and check for signs of compromise.
A logged-in local user can plant a specially crafted DLL file where the program looks for libraries, tricking it into running attacker code with the app's privileges; this is being exploited in the wild. Siemens Software Center. Apply the vendor's mitigations now and check for signs of compromise, such as unexpected DLL files in the application's search directories.
A remote attacker can bypass login by spoofing identity and then perform file operations on the appliance, and this flaw is being actively exploited. BeyondTrust Remote Support. Apply the vendor's update now and check for signs of compromise.
An attacker with admin-level login can use specific command-line commands to write or delete arbitrary files on the device, and this flaw is being actively exploited. Fortinet FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. Apply the vendor's fixes and mitigations now, and check for signs of compromise.
An unauthenticated attacker can access files inside the web application's root directory without logging in, and this flaw is being actively exploited. Atlassian Data Center products: Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible and Fisheye. Apply the vendor's update now and check for signs of compromise.
Attackers can run operating system commands on the server by tampering with a parameter in a web request, and this flaw is being actively exploited. Ahsay AhsayCBS. Apply the vendor's update now and check for signs of compromise.
An unauthenticated remote attacker can write arbitrary files onto the underlying operating system, and this flaw is being actively exploited. Cisco Secure Email Gateway. Apply the vendor's mitigations or update now, and check for signs of compromise.
A remote attacker can bypass login checks in AhsayCBS by manipulating a parameter sent to its API, and this flaw is being actively exploited in the wild. Ahsay AhsayCBS; no fixed versions are listed, so this applies to all AhsayCBS deployments. Apply the vendor's update now and check for signs of compromise, including unexpected admin logins or new accounts.
An authenticated attacker with network access can run arbitrary code with root privileges on the firewall, and this flaw is being exploited in the wild. Palo Alto Networks PAN-OS. Apply the vendor's mitigations and update now, and check for signs of compromise.
A remote attacker with no login can bypass authentication by spoofing and run arbitrary commands on the device, and this flaw is being actively exploited. Ivanti Connect Secure. Apply the vendor's mitigations or update now, and check for signs of compromise.
An unauthorized attacker over a network can bypass a Windows security feature through a command injection flaw, and this flaw is being actively exploited. Microsoft Windows Shell. Apply the vendor's update now and check for signs of compromise.
Remote attackers can crash the BIND DNS server by sending specially crafted TKEY queries, causing denial of service, and this flaw is being actively exploited. ISC BIND DNS server software. Apply the vendor's update now and check for signs of compromise, such as unexpected DNS server crashes or restarts.
Remote attackers can run their own commands on servers through a crafted method: prefix when Dynamic Method Invocation is enabled, and this flaw is being actively exploited. Apache Struts, Maven org.apache.struts:struts2-core versions 2.3.20 through 2.3.28. Upgrade to fixed versions 2.3.20.3, 2.3.24.3, or 2.3.28.1 now, and check for signs of compromise.
Attackers who can log into the Strapi admin panel can use query filters to read sensitive user details stored in cleartext, and it is being exploited in the wild and can be chained toward remote code execution. Strapi (npm package @strapi/strapi), versions 3.2.1 up to but not including 4.8.0. Upgrade @strapi/strapi to 4.8.0 or later now, and check for signs of compromise such as unexpected admin logins or unusual query activity.
Attackers are actively exploiting a path traversal flaw, using a /.. sequence in an image upload parameter when JWT is enabled, which can lead to remote code execution on the server. ONLYOFFICE Docs Server, installations that use JWT. Apply the vendor's update now and check for signs of compromise.
Remote attackers can read and write arbitrary files on the server through the site cpfr and site cpto commands, and this flaw is being actively exploited. ProFTPD (ProFTPD server; no versions given in the advisory). Apply the vendor's update now and check for signs of compromise.
An attacker can crash Citrix NetScaler devices through a memory buffer bug, and this flaw is being actively exploited in the wild. Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway). Apply the vendor's update now and check for signs of compromise.
Summaries are written by AI from the linked sources and regenerated when a source changes.