EUVD-2022-33315

Malicious code in bioql PyPI...

EUVD-2025-21896

Malicious code in bioql PyPI...

EUVD-2023-1450

Malicious code in bioql PyPI...

EUVD-2024-45588

Malicious code in bioql PyPI...

EUVD-2022-7005

Malicious code in bioql PyPI...

EUVD-2024-2172

Malicious code in bioql PyPI...

EUVD-2024-50869

Malicious code in bioql PyPI...

CVE-2024-49731: Incorrect Privilege Assignment

In apk-versions.txt, there is a possible corruption of telemetry opt-in settings on other watches when setting up a new Pixel Watch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for...

Developer verification: a promised lift for Android security

To reduce the number of harmful apps targeting Android users, Google has announced that certified Android devices will require all apps to be registered by verified developers in order to be installed. But this new measure is not just about malware that's found on the Google Play Store, it’s main...

Malicious code in @zalastax/nolb-apk (npm)

The package @zalastax/nolb-apk was found to contain malicious code...

Malicious code in snap-score-new-apk-ios448 (npm)

The package snap-score-new-apk-ios448 was found to contain malicious code...

MAL-2025-33490 Malicious code in snap-score-new-apk-ios448 (npm)

The package snap-score-new-apk-ios448 was found to contain malicious code...

MAL-2025-10688 Malicious code in @zalastax/nolb-apk (npm)

The package @zalastax/nolb-apk was found to contain malicious code...

CVE-2025-54059

melange allows users to build apk packages using declarative pipelines. Starting in version 0.23.0 and prior to version 0.29.5, SBOM files generated by melange in apks had file system permissions mode 666. This potentially allows an unprivileged user to tamper with apk SBOMs on a running image,...

SUSE CVE-2025-54059

melange allows users to build apk packages using declarative pipelines. Starting in version 0.23.0 and prior to version 0.29.5, SBOM files generated by melange in apks had file system permissions mode 666. This potentially allows an unprivileged user to tamper with apk SBOMs on a running image,...

CVE-2025-54059

melange allows users to build apk packages using declarative pipelines. Starting in version 0.23.0 and prior to version 0.29.5, SBOM files generated by melange in apks had file system permissions mode 666. This potentially allows an unprivileged user to tamper with apk SBOMs on a running image,...

CVE-2025-54059 melange creates SBOM files in APKs with world-writable permissions

melange allows users to build apk packages using declarative pipelines. Starting in version 0.23.0 and prior to version 0.29.5, SBOM files generated by melange in apks had file system permissions mode 666. This potentially allows an unprivileged user to tamper with apk SBOMs on a running image,...

CVE-2025-54059

Summary of CVE-2025-54059 (melange) The vulnerability concerns melange creating SBOM files inside APKs with world-writable permissions (mode 666) during build pipelines. It affects versions from 0.23.0 up to, but not including, 0.29.5. This state could allow an unprivileged user to tamper with SB...

CVE-2025-54059 melange creates SBOM files in APKs with world-writable permissions

melange allows users to build apk packages using declarative pipelines. Starting in version 0.23.0 and prior to version 0.29.5, SBOM files generated by melange in apks had file system permissions mode 666. This potentially allows an unprivileged user to tamper with apk SBOMs on a running image,...

CVE-2025-53945 apko has incorrect permission (0666) in /etc/ld.so.cache and other files

apko allows users to build and publish OCI container images built from apk packages. Starting in version 0.27.0 and prior to version 0.29.5, critical files were inadvertently set to 0666, which could likely be abused for root escalation. Version 0.29.5 contains a fix for the issue...