MAL-2025-48197 Malicious code in redirect-noyuan (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bfefab6bff187a106098b7be9862bc879253570f8cd1b97288bd2f4cadbdd08e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48198 Malicious code in redirect-nq70u6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 099d83c25e6a8662b90ff95da62e95d6118eb1d71b1ed785e186f69054ae7f66 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48211 Malicious code in redirect-rrfeb9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e22ca9cad1ad3c1542f31911a710cdf8050641c411840a91fa44f7f81ba3fd36 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in redirect-xs13nr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1049bdaa947906b364017bb13767c04598a526833d572bdc908840a74996a93d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-61783 Python Social Auth - Django has unsafe account association

Python Social Auth is a social authentication/registration mechanism. In versions prior to 5.6.0, upon authentication, the user could be associated by e-mail even if the associatebyemail pipeline was not included. This could lead to account compromise when a third-party authentication service doe...

CVE-2025-61783 Python Social Auth - Django has unsafe account association

Python Social Auth is a social authentication/registration mechanism. In versions prior to 5.6.0, upon authentication, the user could be associated by e-mail even if the associatebyemail pipeline was not included. This could lead to account compromise when a third-party authentication service doe...

CVE-2025-61783

CVE-2025-61783 affects Python Social Auth (specifically the Django integration, python-social-auth/social-app-django). In versions prior to 5.6.0, during authentication a user could be associated by email even if the register/authorization pipeline did not include the associate_by_email step, ena...

GHSA-WV4W-6QV2-QQFG Python Social Auth - Django has unsafe account association

Impact Upon authentication, the user could be associated by e-mail even if the associatebyemail pipeline was not included. This could lead to account compromise when a third-party authentication service does not validate provided e-mail addresses or doesn't require unique e-mail addresses. Patche...

CVE-2025-59957

An Origin Validation Error vulnerability in an insufficient protected file of Juniper Networks Junos OS on EX4600 Series and QFX5000 Series allows an unauthenticated attacker with physical access to the device to create a backdoor which allows complete control of the system. When a device isn't...

Directory Traversal

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Directory Traversal via the WriteFile and ReadFile tools. An attacker can gain full control over the server, including executing arbitrary commands, by supplying crafted file paths that allow...

MAL-2025-48096 Malicious code in @testcarrot/supply10 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8be0caf56c8bfb459fe5af9909f2c71799d54ea1571de12424e205edd9e37c76 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @testcarrot/supply6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1879de03e36cf280adcff93d8fbfe8537bb68de7e372b70c0e6b80adbdfe21bd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @testcarrot/supply (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 27e1f69fb6202f5542f7e1a2def95407b079bad5dd22d4ef58c3f243c794000d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @testcarrot/supply4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 58c554af87914a43458082a747e4709d285f86a900c2c36e1f9d548a0281608e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48098 Malicious code in @testcarrot/supply3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ecbc24cc97adb2847161caf543bbb337374513e26dd4d6d2c83b6d306df7f45d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48102 Malicious code in @testcarrot/supply7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6b3fc279837edb0be645020c30f0d706a43f965e28e6efef716e2283301fe06e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @testcarrot/supply5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1f18175c030df85202e86f90a2f44bcc72e87ad7ebf6cfd7e053c30fb7d76664 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @testcarrot/supply8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 62090c615c296faaa4c5b5daeca903ff5f30ce22e263e583ed7b697159fb17dd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @testcarrot/supply7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6b3fc279837edb0be645020c30f0d706a43f965e28e6efef716e2283301fe06e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48099 Malicious code in @testcarrot/supply4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 58c554af87914a43458082a747e4709d285f86a900c2c36e1f9d548a0281608e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...