USN-7534-1: Flask vulnerability

It was discovered that Flask incorrectly handled key rotation. An attacker could possibly use this issue to sign sessions with stale keys...

MAL-2025-4485 Malicious code in ideals-views (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b431166595255a46759ecab498e49f019b7714c5000ad452f14345bef36264ab Any computer that has this package installed or running should be considered...

MAL-2025-4562 Malicious code in html-report (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 76dfd70352bf673a00030f6d35ad320bc633fad730881d95d897d878d7ce662b Any computer that has this package installed or running should be considered...

MAL-2025-4567 Malicious code in log5j-v2 (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 479704e8ae033e0588a24b1035307680aa38b28cacebb845b306ad8db35d0da9 Any computer that has this package installed or running should be considered...

MAL-2025-4438 Malicious code in iokit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0809d84edd6d3d9ba71ac05151f2564c41a8d94a6e8ee6b57d8237de7ba7720 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4430 Malicious code in apache-iotdb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dff74a911454d2bde3e33e6b60e2dbf0fd679cda9731532351e3766b912c3473 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4456 Malicious code in web3-evm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 47f8566107060326567a6d66ac66f3c457f9a24142c7c3694200e07af63e9e27 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4433 Malicious code in etherna (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 878da0ca7dbd6a63e9de7b962c0012e3ca24afca42be819c3b86af0600939fe2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4441 Malicious code in ml-preprocessing (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 449fa18004b9f5016f86ea6f5c97358b4ca5263d4649325b946379ca51610f63 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4443 Malicious code in mxc-jsbridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a080d6fa2cab7be94e152a7b621f7fd9d0ce62e7a726343e61bfbdf9e676e427 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4440 Malicious code in mexc-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7500b4df256dbb552286c7f37d34b2748ff1b5ef9f95263acf51f4806a5b2bda Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4445 Malicious code in nsubstitute (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77033df9455e373b7e21f347210206adb17103822278b3d6dacaa8b69423cc7d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Ubuntu 25.04 : Flask vulnerability (USN-7534-1)

The remote Ubuntu 25.04 host has a package installed that is affected by a vulnerability as referenced in the USN-7534-1 advisory. It was discovered that Flask incorrectly handled key rotation. An attacker could possibly use this issue to sign sessions with stale keys. Tenable has extracted the...

MAL-2025-4539 Malicious code in @fff-web/fff-utilities (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b538001307782f76d2333a860fd4464fcd00ee81502f585e177ec62b0541262 Any computer that has this package installed or running should be considered...

MAL-2025-4366 Malicious code in koishi-plugin-majjan-nanikiri (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6887f78c1033e92ccb5aab19fb7c9403c34d9136624def09f8944b43603dfdeb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4341 Malicious code in eslint-typescript-runtime-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware be050b4e52992e8c09c9654e29825a2715f4b5a07c8b11c06bcb61163c525354 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4388 Malicious code in plugin-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6894a10f2cae1576d4b28556e817ceae00aa303e12f88eeca933fcc6c0c8f891 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-42806

Hydra is the layer-two scalability solution for Cardano. Prior to version 0.13.0, not signing and verifying $\mathsfcid$ allows an attacker which must be a participant of this head to use a snapshot from an old head instance with the same participants to close the head or contest the state with i...

CVE-2023-47640

DataHub is an open-source metadata platform. The HMAC signature for DataHub Frontend sessions was being signed using a SHA-1 HMAC with the frontend secret key. SHA1 with a 10 byte key can be brute forced using sufficient resources i.e. state level actors with large computational capabilities...

MAL-2025-4348 Malicious code in fs-path-info (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a5bbb0034c7f631436e49a1e2a5c4a5f80204c56e46a101701eeb40d7947eb39 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...