MAL-2025-46910 Malicious code in github-orca (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 83776c9c0b12c59a169cd0eb6d85e38ce8ae930d21f9d837edf0acd9e2bdccf1 The OpenSSF Package Analysis project identified 'github-orca' @ 0.0.20.1626.gb0c19ef3 rubygems as malicious. It is considered malicious because:...

MAL-2025-46908 Malicious code in github-kredz (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 537bf1dc9a46b4e69b596275e61de6d1b75ca3eeb2979bde507688f07458c088 The OpenSSF Package Analysis project identified 'github-kredz' @ 1.0.1.1135.gf4a4623f5 rubygems as malicious. It is considered malicious because...

Malicious code in github-kredz (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 537bf1dc9a46b4e69b596275e61de6d1b75ca3eeb2979bde507688f07458c088 The OpenSSF Package Analysis project identified 'github-kredz' @ 1.0.1.1135.gf4a4623f5 rubygems as malicious. It is considered malicious because...

CVE-2025-58161

creationtimestamp| type| source ---|---|--- 2025-08-31 02:36:04+00:00| published-proof-of-concept| https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-ccc3-fvfx-mw3v...

VULSOVER: Vulnerability Detection Via LLM-Driven Constraint Solving

Traditional vulnerability detection methods rely heavily on predefined rule matching, which often fails to capture vulnerabilities accurately. With the rise of large language models LLMs, leveraging their ability to understand code semantics has emerged as a promising direction for achieving more...

GHSA-XH9H-692F-MMG4 vulnerabilities

Vulnerabilities for packages: py3-knack, az...

Linux Distros Unpatched Vulnerability : CVE-2025-47928

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Spotipy is a Python library for the Spotify Web API. As of commit 4f5759dbfb4506c7b6280572a4db1aabc1ac778d, using pullrequesttarget on...

Linux Distros Unpatched Vulnerability : CVE-2022-2882

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 15.2.5, all versions starting from 15.3 before 15.3.4, all version...

Linux Distros Unpatched Vulnerability : CVE-2022-0154

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab affecting all versions starting from 7.7 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions...

Linux Distros Unpatched Vulnerability : CVE-2020-13326

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was discovered in GitLab versions prior to 13.1. Under certain conditions the restriction for Github project import could be bypassed...

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal via insufficient validation in the getConfigFile function in the UIConfigRest class. An attacker can gain unauthorized access to files located in directories that share a common prefix with the intended folder by...

CVE-2025-9658

A flaw has been found in O2OA up to 10.0-410. Impacted is an unknown function of the file /xportalassembledesigner/jaxrs/dict/ of the component Personal Profile Page. This manipulation of the argument name/alias/description causes cross site scripting. Remote exploitation of the attack is possibl...

GO-2025-3909 Dpanel has an arbitrary file read vulnerability in github.com/donknap/dpanel

Dpanel has an arbitrary file read vulnerability in github.com/donknap/dpanel...

GO-2025-3896 Default Credentials in nginx-defender Configuration Files in github.com/Anipaleja/nginx-defender

Default Credentials in nginx-defender Configuration Files in github.com/Anipaleja/nginx-defender...

CVE-2025-9649

A security vulnerability has been detected in appneta tcpreplay 4.5.1. Impacted is the function calcsleeptime of the file sendpackets.c. Such manipulation leads to divide by zero. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. Upgrading to version...

GHSA-557Q-795J-WFX2

creationtimestamp| type| source ---|---|--- 2025-08-28 15:21:47+00:00| seen| Telegram/OyabcahpfrRge5QjGUggaxZXnWCpNvKMmkJan1LpXorqoOs...

Malicious Nx Packages in 's1ngularity' Attack Leaked 2,349 GitHub, Cloud, and AI Credentials

The maintainers of the nx build system have alerted users to a supply chain attack that allowed attackers to publish malicious versions of the popular npm package and other auxiliary plugins with data-gathering capabilities. "Malicious versions of the nx package, as well as some supporting plugin...

Malicious code in @nx/key (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a77d672a4263588b96bbf3fbf8ddbd4e1e7b6ee0bccd619a447bf9e301883b3 The package @nx/[email protected] is published under the @nx scope and ships a heavily obfuscated JavaScript file native.js using hex-mangled identifiers...

GHSA-C2GV-XGF5-5CC2

creationtimestamp| type| source ---|---|--- 2025-08-27 18:57:20+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115102255675248188...

Malicious versions of Nx were published

Summary Malicious versions of the nx package, as well as some supporting plugin packages, were published to npm, containing code that scans the file system, collects credentials, and posts them to GitHub as a repo under user's accounts. Immediate Actions Required For all users, check if you were...