CVE-2025-58759

TinyEnv is a PHP environment variable loader affected in versions 1.0.9 and 1.0.10 where inline comments inside .env values are not stripped, allowing unintended characters and potential misconfigurations or authentication failures. Root cause: improper handling of inline comments during parsing....

CVE-2025-58759 TinyEnv: Inline comments not stripped properly in .env values

TinyEnv is an environment variable loader for PHP applications. In versions 1.0.9 and 1.0.10, TinyEnv did not properly strip inline comments inside .env values. This could lead to unexpected behavior or misconfiguration, where variables contain unintended characters including or comment text...

CVE-2025-58758 TinyEnv: Missing .env file not required — may cause unexpected behavior

TinyEnv is an environment variable loader for PHP applications. In versions 1.0.1, 1.0.2, 1.0.9, and 1.0.10, TinyEnv did not require the .env file to exist when loading environment variables. This could lead to unexpected behavior where the application silently ignores missing configuration,...

CVE-2025-58758 TinyEnv: Missing .env file not required — may cause unexpected behavior

TinyEnv is an environment variable loader for PHP applications. In versions 1.0.1, 1.0.2, 1.0.9, and 1.0.10, TinyEnv did not require the .env file to exist when loading environment variables. This could lead to unexpected behavior where the application silently ignores missing configuration,...

PT-2025-36952

Name of the Vulnerable Software and Affected Versions: TinyEnv versions 1.0.1 through 1.0.2 TinyEnv versions 1.0.9 through 1.0.10 Description: TinyEnv did not require the .env file to exist when loading environment variables. This could lead to unexpected behavior where the application silently...

Alibaba Cloud Linux 3 : 0151: resource-agents (ALINUX3-SA-2025:0151)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2025:0151 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2024-47081: Requests is a HTTP library. Due to ...

CVE-2025-58373

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a vulnerability where .rooignore protections could be bypassed using symlinks. This allows an attacker with write access to the workspace to trick the extension into reading files th...

CVE-2025-58373

Roo Code (editor-integrated AI coding agent) versions 3.25.23 and earlier contain a symlink-based bypass of the .rooignore protections. An attacker with write access to the workspace could trick the extension into reading files that should be excluded (for example, .env or other configuration dat...

MAL-2025-43889 Malicious code in convict-fomalhaut-morgan-cross-env (npm)

The package convict-fomalhaut-morgan-cross-env was found to contain malicious code...

MAL-2025-43430 Malicious code in algol-cross-env-biomimicry-semantic-ui (npm)

The package algol-cross-env-biomimicry-semantic-ui was found to contain malicious code...

MAL-2025-44124 Malicious code in elektra-cross-env-deimos-ganymede (npm)

The package elektra-cross-env-deimos-ganymede was found to contain malicious code...

Malicious code in algol-cross-env-biomimicry-semantic-ui (npm)

The package algol-cross-env-biomimicry-semantic-ui was found to contain malicious code...

Malicious code in cross-env-html-webpack-plugin-writable-dactyl (npm)

The package cross-env-html-webpack-plugin-writable-dactyl was found to contain malicious code...

Malicious code in zephyr-electron-builder-cross-env-cressida (npm)

The package zephyr-electron-builder-cross-env-cressida was found to contain malicious code...

MAL-2025-43910 Malicious code in cross-env-html-webpack-plugin-writable-dactyl (npm)

The package cross-env-html-webpack-plugin-writable-dactyl was found to contain malicious code...

Malicious code in elektra-cross-env-deimos-ganymede (npm)

The package elektra-cross-env-deimos-ganymede was found to contain malicious code...

Malicious code in convict-fomalhaut-morgan-cross-env (npm)

The package convict-fomalhaut-morgan-cross-env was found to contain malicious code...

MAL-2025-43911 Malicious code in cross-env-proteomics-superposition-geomorphology (npm)

The package cross-env-proteomics-superposition-geomorphology was found to contain malicious code...

Security Bulletin: IBM Cognos Dashboards on Cloud Pak for Data has addressed security vulnerabilities.

Summary There are vulnerabilities in IBM® Semeru Runtime and Open-Source Software OSS components consumed by IBM Cognos Dashboards on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2025-25193 DESCRIPTION: Netty, an asynchronous, event-driven network application framework, has a vulnerability...

Malicious code in import-license-checker (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c41ca4c8119fa20f7f5915b34de59f879b77fedf237cbbf5a69e46ddbeded428 Package exfiltrates content of .env files to a remote target --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...