Malicious code in @zalastax/nolb-ca_ (npm)

The package @zalastax/nolb-ca was found to contain malicious code...

Malicious code in @zalastax/nolb-ca- (npm)

The package @zalastax/nolb-ca- was found to contain malicious code...

MAL-2025-10851 Malicious code in @zalastax/nolb-ca- (npm)

The package @zalastax/nolb-ca- was found to contain malicious code...

Malicious code in @zalastax/nolb-ca (npm)

The package @zalastax/nolb-ca was found to contain malicious code...

MAL-2025-12650 Malicious code in @zalastax/nolb-node-red-ca (npm)

The package @zalastax/nolb-node-red-ca was found to contain malicious code...

MAL-2025-16415 Malicious code in ca-npm-scripts (npm)

The package ca-npm-scripts was found to contain malicious code...

MAL-2025-10850 Malicious code in @zalastax/nolb-ca (npm)

The package @zalastax/nolb-ca was found to contain malicious code...

CVE-2025-0309: Improper Certificate Validation

An insufficient validation on the server connection endpoint in Netskope Client allows local users to elevate privileges on the system. The insufficient validation allows Netskope Client to connect to any other server with Public Signed CA TLS certificates and send specially crafted responses to...

CVE-2023-5342: Use of a Key Past its Expiration Date

The Fedora Secure Boot CA certificate shipped with shim in Fedora was expired which could lead to old or invalid signed boot components being loaded...

[SECURITY] [DLA 4269-1] ca-certificates-java bugfix update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4269-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucariès August 11, 2025 https://wiki.debian.org/LTS -...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: apm-server, trivy, kine, nvidia-nsight-compute-13.1, kubernetes-csi-driver-nfs, kube-logging-logging-operator, otel-cli, guac, rancher-webhook-fips, k8s-device-plugin, terraform-provider-kubernetes-fips, yam, gotestsum, nri-cassandra, tigera-operator-fips, pguser,...

SUSE CVE-2025-54799

Let's Encrypt client and ACME library written in Go Lego. In versions 4.25.1 and below, the github.com/go-acme/lego/v4/acme/api package thus the lego library and the lego cli as well don't enforce HTTPS when talking to CAs as an ACME client. Unlike the http-01 challenge which solves an ACME...

CVE-2025-54799

Let's Encrypt client and ACME library written in Go Lego. In versions 4.25.1 and below, the github.com/go-acme/lego/v4/acme/api package thus the lego library and the lego cli as well don't enforce HTTPS when talking to CAs as an ACME client. Unlike the http-01 challenge which solves an ACME...

CLSA-2025-1754382679 Update of alt-php

Update ca-certificates database to 20250418: - mozilla\certdata.h,nssckbi.h: Update Mozilla certificate authority bundle of the version 2.74. - The following certificates were updated: Certificate "Entrust.net Premium 2048 Secure Server CA" Certificate "Entrust Root Certification Authority"...

CLSA-2025-1754382436 Update of alt-php

Update ca-certificates database to 20250418: - mozilla\certdata.h,nssckbi.h: Update Mozilla certificate authority bundle of the version 2.74. - The following certificates were updated: Certificate "Entrust Root Certification Authority - G4" Certificate "Security Communication ECC RootCA1"...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the verifyCredentials. An attacker can impersonate a trusted client by crafting a malicious certificate when a non-CA certificate is used as a trusted certificate. Remediation Upgrade...

GHSA-6C5R-4WFC-3MCX Hashicorp Vault has Incorrect Validation for Non-CA Certificates

Vault and Vault Enterprise “Vault” TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as +trusted certificate+|https://developer.hashicorp.com/vault/api-docs/auth/certcertificate. In this configuration, an attacker may be able to...

CVE-2025-6037 Vault Certificate Auth Method Did Not Validate Common Name For Non-CA Certificates

Vault and Vault Enterprise “Vault” TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as +trusted certificate+|https://developer.hashicorp.com/vault/api-docs/auth/certcertificate. In this configuration, an attacker may be able to...

Exploit for CVE-2025-54589

CVE-2025-54589 – Copyparty Reflected XSS Author: Byte Rea...

Security update 5.1.0 GM for Multi-Linux Manager Client Tools

This update fixes the following issues: spacecmd: Version update from 5.1.6-0 to 5.1.8-0 with the following key change: Update translation strings uyuni-tools: Version 5.1.14-0: Fix mgradm backup create handling of images and systemd files bsc1244563 migrate existing TLS certificates from 4.3...