31519 matches found
Malicious code in jsonwebauth (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 683ba88a9e72aab5f114bdd388e92a35230a3fcad8178b8c8d5e5e6fddf7b829 The package jsonwebauth was found to contain malicious code. Source: ghsa-malware c1c270e023225a3ab0872fa3ea9f9b94b0320639bdaa6fb0d30e9b65c9ba1db2 An...
Malicious code in manage-root (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ade61c26597c5b0a24785713d87a304ddf30ae13dd50c69ba89e653ec4c2729 The package manage-root was found to contain malicious code. Source: ghsa-malware 6b0fc8397f56e86ac97a5adedd2c89de19045dffbdabbf982ffcf5944449b178 An...
MAL-2026-402 Malicious code in vworldviewdir (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0b210fefd46c64493bc3663c4af48a69cac8f12908d33018d20697bd2085c7c The package vworldviewdir was found to contain malicious code. Source: ghsa-malware 3dfab7849c9725e5a6853c4868c0e27a4013044ba3aa7602eb9fbb06bf714f62...
MAL-2026-403 Malicious code in worldnormal (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 406eb16c91569acae88fa2f33de6107f6a758568c40b800908ac924d1a7e87fd The package worldnormal was found to contain malicious code. Source: ghsa-malware 1c9bf70b2f92f241477ec0cae21b7f094e1d4d1090cbb837bfd90fa9430f26ac An...
MAL-2026-383 Malicious code in @mikudev/ridwan-signal (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c96124a8175a81f43ffbd0c2b9acc96782560b9e737266ccac47204d9605f31 The package @mikudev/ridwan-signal was found to contain malicious code. Source: ghsa-malware...
Malicious code in tor-libsignal (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3281075aed24ae2af07fd17a56499318dcd8cd0fa836f60e1fa76814b90c2742 The package tor-libsignal was found to contain malicious code. Source: ghsa-malware 25164e8116dd5f0b085529d972fb628013ac35df2065ee934693a23bd13da788...
Mailpit has a Server-Side Request Forgery (SSRF) via HTML Check API
Server-Side Request Forgery SSRF via HTML Check CSS Download The HTML Check feature /api/v1/message/ID/html-check is designed to analyze HTML emails for compatibility. During this process, the inlineRemoteCSS function automatically downloads CSS files from external tags to inline them for testing...
GHSA-6JXM-FV7W-RW5J Mailpit has a Server-Side Request Forgery (SSRF) via HTML Check API
Server-Side Request Forgery SSRF via HTML Check CSS Download The HTML Check feature /api/v1/message/ID/html-check is designed to analyze HTML emails for compatibility. During this process, the inlineRemoteCSS function automatically downloads CSS files from external tags to inline them for testing...
Linux Distros Unpatched Vulnerability : CVE-2025-10569
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed...
Debian dsa-6104 : python-keystonemiddleware-doc - security update
The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6104 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6104-1 [email protected] https://www.debian.org/security/ Moritz...
Konica Bizhub Multifunction Printers Insufficiently Protected Credentials (CVE-2024-51984)
An authenticated attacker can reconfigure the target device to use an external service such as LDAP or FTP controlled by the attacker. If an existing password is present for an external service, the attacker can force the target device to authenticate to an attacker controlled device using the...
External Secrets Security Vulnerabilities
External Secrets is an open-source Kubernetes-related application developed by External Secrets. There were security vulnerabilities in versions 0.20.2 to 1.2.0 of External Secrets. These vulnerabilities stemmed from the getSecretKey template function, which allowed access to secrets across...
Copier security vulnerabilities
Copier is an open-source library used for rendering project templates by Copier. Versions of Copier prior to 9.11.2 contained security vulnerabilities. These vulnerabilities stemmed from the use of symbolic links and default settings, which could lead to the inclusion of files or directories...
[SECURITY] [DSA 6104-1] python-keystonemiddleware security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6104-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff January 20, 2026 https://www.debian.org/security/faq -...
CVE-2026-23845
Mailpit is an email testing tool and API for developers. Versions prior to 1.28.3 are vulnerable to Server-Side Request Forgery SSRF via HTML Check CSS Download. The HTML Check feature /api/v1/message/ID/html-check is designed to analyze HTML emails for compatibility. During this process, the...
GHSA-7JC7-G598-2P64 XDocReport affected by an XML External Entity (XXE) vulnerability
An XML External Entity XXE vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploading a crafted .docx file...
GHSA-77V3-R3JW-J2V2 External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function
Summary The getSecretKey template function, while introduced for senhasegura Devops Secrets Management DSM provider, has the ability to fetch secrets cross-namespaces with the roleBinding of the external-secrets controller, bypassing our security mechanisms. This function was completely removed, ...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization via the getSecretKey function. An attacker can gain unauthorized access to secrets across namespaces by exploiting the function's ability to bypass security mechanisms and retrieve secrets using elevated...
External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function
Summary The getSecretKey template function, while introduced for senhasegura Devops Secrets Management DSM provider, has the ability to fetch secrets cross-namespaces with the roleBinding of the external-secrets controller, bypassing our security mechanisms. This function was completely removed, ...
