Malicious code in import-remotes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a2e0a548eedf5be8e5880c40fba2c0a01717632b836bb368efcff5e9e4c58988 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in meta-ai-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 230f2c424df3ca5115f3d575ba5a15c46f2a591f9a8ed4ec503c6bb5490ea355 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in doges (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 318e443cd5d84f016e8bfb0f1d2bafd4ccc2749c5ba81e01f0175207db159d06 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in creativehub (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 53c5f1c467c1379a489454fff19c45455e35310c2cbd03b9cbf02cce6daa45ea Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-2241

A flaw was found in Hive, a component of Multicluster Engine MCE and Advanced Cluster Management ACM. This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to ClusterProvision objects can extract...

Malicious code in cmp-dossier-tracking (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ca47cddd0ff04336d55d7da2799d42183ab77e8b7270202739f7728e7904f712 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-17932

Name of the Vulnerable Software and Affected Versions Commvault Web Server versions prior to 11.36.46 Commvault Web Server versions prior to 11.32.89 Commvault Web Server versions prior to 11.28.141 Commvault Web Server versions prior to 11.20.217 Description An unspecified vulnerability in the...

Vulnerabilities fixed in Ivanti Connect Secure and Policy Secure

Ivanti has fixed vulnerabilities in Connect Secure and Policy Secure. The first vulnerability CVE-2025-0282 can be exploited by malicious parties to execute arbitrary code remotely without authentication. The second vulnerability CVE-2025-0283 can be exploited by a locally authenticated malicious...

Malicious code in commitlint-config-jira-type-infra (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d3a60114c639e9e20430efd4c98505d38340a52eece4ea1eb6eca3117556cc63 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bwiueor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a58c7ce1a6c1340dfe0646fa5ffe8b5916b1476bd1c511dde3c799c8d93b37d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @diotoborg/adipisci-dolorum (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 25197e9e088ad34533dc96dc9c5ae4a5d8a6d916854e9df033f73e650db7538a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @diotoborg/autem-vero (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 239c77c66f6ccb8f7dcbcbd73746657981045cbd106678133760ac1a486b680c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @isp-frontend-library/melidata (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 82746032892e802ace53b17af4c8d10cca1a7c07e3908a3a058be62eb64fe9ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-37150

An issue in .npmrc support in Deno 1.44.0 was discovered where Deno would send .npmrc credentials for the scope to the tarball URL when the registry provided URLs for a tarball on a different domain. All users relying on .npmrc are potentially affected by this vulnerability if their private...

Malicious code in @lognex/ecom-recommendations (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f0ab65eb1c1e53ad84ab09e9426d718197e6137500c81a66639f4e4249e39edb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @zettle-bo/vertical-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 29df8a3283a276676a3afb1f56cc288ff4ceceb1d591ec934732ccdc9d109cad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ozstesting-pt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd890b0f1505256856827c172f048855f0dff526343f90fafb44920827544ff5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE CVE-2022-24716

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including icingaweb2 configuration files with database credentials. This issue has been resolv...

CVE-2023-0690: Cleartext Storage of Sensitive Information

HashiCorp Boundary from 0.10.0 through 0.11.2 contain an issue where when using a PKI-based worker with a Key Management Service KMS defined in the configuration file, new credentials created after an automatic rotation may not have been encrypted via the intended KMS. This would result in the...

You Don't Know Where Your Secrets Are

Do you know where your secrets are? If not, I can tell you: you are not alone. Hundreds of CISOs, CSOs, and security leaders, whether from small or large companies, don't know either. No matter the organization's size, the certifications, tools, people, and processes: secrets are not visible in 9...