CVE-2025-54864 Hydra missing authentication when triggering evaluations through GitHub and Gitea plugins

Hydra is a continuous integration service for Nix based projects. Prior to commit f7bda02, /api/push-github and /api/push-gitea are called by the corresponding forge without HTTP Basic authentication. Both forges do however feature HMAC signing with a secret key. Triggering an evaluation can be...

CVE-2025-54864 Hydra missing authentication when triggering evaluations through GitHub and Gitea plugins

Hydra is a continuous integration service for Nix based projects. Prior to commit f7bda02, /api/push-github and /api/push-gitea are called by the corresponding forge without HTTP Basic authentication. Both forges do however feature HMAC signing with a secret key. Triggering an evaluation can be...

GHSA-QX2V-8332-M4FV vulnerabilities

Vulnerabilities for packages: linkerd-extension-init, efs-utils, uv, buck2, shadowsocks-rust, jujutsu, zola, linkerd2, pixi, linkerd2-proxy, mdbook...

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues: Update to version 0.0.20250806T202249 2025-08-06T20:22:49Z jscPED-11136 GO-2022-0392 GHSA-m6gx-rhvj-fh52 GO-2022-0396 GHSA-g54h-m393-cpwq GO-2022-0452 GHSA-f3fp-gc8g-vw66 GO-2022-0456 GHSA-wjxw-gh3m-7pm5 GO-2022-0617 GHSA-qh36-44jv-c8...

curl: Account/Repository Takeover via Abandoned GitHub Username in curl's href_extractor.c

Summary: The hrefextractor.c example in the curl repository https://github.com/curl/curl/blob/master/docs/examples/hrefextractor.c references an external HTML parser library hosted at https://github.com/arjunc77/htmlstreamparser. The referenced GitHub username arjunc77 or repository...

Malicious code in kertash (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3cb3ef6da7e0d1c1461bb944c5ff0e356b73e52d271afa9e94435097f1d0764f When using methods from the package, it downloads an obfuscated code from Github and puts it in multiple localisation. While it appears that this code is used ...

GitHub Copilot and Visual Studio Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command 'command injection' in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code locally...

GHSA-3R4F-MM4W-WGG6

creationtimestamp| type| source ---|---|--- 2025-08-12 02:12:37+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115013370259680188...

GHSA-5FG8-WVX3-583X

creationtimestamp| type| source ---|---|--- 2025-08-12 02:12:37+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115013370259680188...

Security Bulletin: NVIDIA NeMo Framework - August 2025

NVIDIA has released a software update for NVIDIA® NeMo Framework. To protect your system, download and install the latest NVIDIA Nemo Framework from NVIDIA GitHub. Go to NVIDIA Product Security...

Security Bulletin: NVIDIA WebDataset - August 2025

NVIDIA has released a software update for NVIDIA WebDataset. To protect your system, install the software including the Github commit 9e95f50 of NVIDIA WebDataset. Go to NVIDIA Product Security...

Intel® Xeon® 6 Scalable Processors Advisory

Summary: A potential security vulnerability in Intel® Xeon® 6 Scalable processors may allow escalation of privilege. Intel is releasing a microcode update to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2025-22840 Description: Sequence of processor instructions leads t...

Security Bulletin: NVIDIA Isaac-GR00T - August 2025

NVIDIA has released a software update for NVIDIA Isaac-GR00T. To protect your system, install the software including the Github commit 9ca97e1 of NVIDIA Isaac-GR00T. Go to NVIDIA Product Security...

Security Bulletin: NVIDIA Apex - August 2025

NVIDIA has released a software update for NVIDIA Apex. To protect your system, install the software including the Github release 25.07 of NVIDIA Apex. Go to NVIDIA Product Security...

Device Plugins for Kubernetes Advisory

Summary: A potential security vulnerability for some Device Plugins for Kubernetes software maintained by Intel may allow denial of service. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2025-24313 Description: Improper access...

Security Bulletin: NVIDIA Megatron LM - August 2025

NVIDIA has released a software update for NVIDIA® Megatron LM. To protect your system, clone or update this software to version 0.12.2 or later from Releases · NVIDIA/Megatron-LM on GitHub. Go to NVIDIA Product Security...

GHSA-X34M-39XW-G2WR

creationtimestamp| type| source ---|---|--- 2025-08-11 21:35:54+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115012282201647161...

GO-2025-3851 Ollama allows deletion of arbitrary files in github.com/ollama/ollama

Ollama allows deletion of arbitrary files in github.com/ollama/ollama...

GO-2025-3859 OpenBao LDAP MFA Enforcement Bypass When Using Username As Alias in github.com/openbao/openbao

OpenBao LDAP MFA Enforcement Bypass When Using Username As Alias in github.com/openbao/openbao. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabilit...

GO-2025-3857 OpenBao Root Namespace Operator May Elevate Token Privileges in github.com/openbao/openbao

OpenBao Root Namespace Operator May Elevate Token Privileges in github.com/openbao/openbao. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...