EUVD-2024-21968

Malicious code in bioql PyPI...

EUVD-2024-2762

Malicious code in bioql PyPI...

EUVD-2025-20840

Malicious code in bioql PyPI...

EUVD-2025-16588

Malicious code in bioql PyPI...

EUVD-2023-40564

Malicious code in bioql PyPI...

EUVD-2021-9317

Malicious code in bioql PyPI...

EUVD-2022-4363

Malicious code in bioql PyPI...

EUVD-2022-3762

Malicious code in bioql PyPI...

EUVD-2021-30007

Malicious code in bioql PyPI...

EUVD-2022-31222

Malicious code in bioql PyPI...

EUVD-2023-1966

Malicious code in bioql PyPI...

EUVD-2022-5453

Malicious code in bioql PyPI...

EUVD-2024-3383

Malicious code in bioql PyPI...

CVE-2025-55191

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions between 2.1.0 and 2.14.19, 3.2.0-rc1, 3.1.0-rc1 through 3.1.7, and 3.0.0-rc1 through 3.0.18 contain a race condition in the repository credentials handler that can cause the Argo CD server to panic and crash when...

CVE-2025-55191 Repository Credentials Race Condition Crashes Argo CD Server

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions between 2.1.0 and 2.14.19, 3.2.0-rc1, 3.1.0-rc1 through 3.1.7, and 3.0.0-rc1 through 3.0.18 contain a race condition in the repository credentials handler that can cause the Argo CD server to panic and crash when...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. Compromised versions of this package contain a file called bundle.js that exfiltrates secrets from the user's accounts, including credentials and API tokens. It also downloads malicious files and repackages them...

GO-2025-3934 Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd

Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd...

CVE-2025-58401

Obsidian GitHub Copilot Plugin versions prior to 1.1.7 store Github API token in cleartext form. As a result, an attacker may perform unauthorized operations on the linked Github account...

CVE-2025-58401: Cleartext Storage of Sensitive Information

Obsidian GitHub Copilot Plugin versions prior to 1.1.7 store Github API token in cleartext form. As a result, an attacker may perform unauthorized operations on the linked Github account...

PT-2025-36609

Summary Argo CD API tokens with project-level permissions are able to retrieve sensitive repository credentials usernames, passwords through the project details API endpoint, even when the token only has standard application management permissions and no explicit access to secrets. Component:...