Evope 1.1.3.20 Hardcoded Cryptographic Key

The component Evope Core in Evope version 1.1.3.20 uses a hardcoded cryptographic key, which means that encryption/decryption keys are permanently embedded in the source code, rather than being securely managed. This creates a critical security flaw because anyone who gains access to or...

CVE-2025-54887

jwe is a Ruby implementation of the RFC 7516 JSON Web Encryption JWE standard. In versions 1.1.0 and below, authentication tags of encrypted JWEs can be brute forced, which may result in loss of confidentiality for those JWEs and provide ways to craft arbitrary JWEs. This puts users at risk becau...

SUSE CVE-2025-54887

jwe is a Ruby implementation of the RFC 7516 JSON Web Encryption JWE standard. In versions 1.1.0 and below, authentication tags of encrypted JWEs can be brute forced, which may result in loss of confidentiality for those JWEs and provide ways to craft arbitrary JWEs. This puts users at risk becau...

CVE-2025-54887

CVE-2025-54887 affects the Ruby library jwe (Ruby implementation of RFC 7516) in versions 1.1.0 and earlier. The auth tag of encrypted JWEs can be brute-forced, enabling modification of JWEs to yield arbitrary plaintext and potentially revealing the GHASH key, which requires rotating keys after u...

CVE-2025-54887 jwe: Missing AES-GCM authentication tag validation in encrypted JWEs

jwe is a Ruby implementation of the RFC 7516 JSON Web Encryption JWE standard. In versions 1.1.0 and below, authentication tags of encrypted JWEs can be brute forced, which may result in loss of confidentiality for those JWEs and provide ways to craft arbitrary JWEs. This puts users at risk becau...

CVE-2025-54887 jwe: Missing AES-GCM authentication tag validation in encrypted JWEs

jwe is a Ruby implementation of the RFC 7516 JSON Web Encryption JWE standard. In versions 1.1.0 and below, authentication tags of encrypted JWEs can be brute forced, which may result in loss of confidentiality for those JWEs and provide ways to craft arbitrary JWEs. This puts users at risk becau...

GHSA-C7P4-HX26-PR73 JWE is missing AES-GCM authentication tag validation in encrypted JWE

Overview The authentication tag of encrypted JWEs can be brute forced, which may result in loss of confidentiality for those JWEs and provide ways to craft arbitrary JWEs. Impact - JWEs can be modified to decrypt to an arbitrary value - JWEs can be decrypted by observing parsing differences - The...

JWE is missing AES-GCM authentication tag validation in encrypted JWE

Overview The authentication tag of encrypted JWEs can be brute forced, which may result in loss of confidentiality for those JWEs and provide ways to craft arbitrary JWEs. Impact - JWEs can be modified to decrypt to an arbitrary value - JWEs can be decrypted by observing parsing differences - The...

MAL-2025-6388 Malicious code in dhei-0731-pkg2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe8d7b6c360cad159d0e612206bf57a2317fd56b354a52d680325314989891c6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6682 Malicious code in epic-games-nav-share (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c5c0876d33c9155274a0eaba4f29d9351f9cfa32ddf6363ae74258d56185de63 Any computer that has this package installed or running should be considered...

MAL-2025-6352 Malicious code in @hypervector/hypervector-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c545f2259849fbb80d4250dcbd736a7ec8fda86cb48ffb7b4a2b1b6eaacfa614 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6364 Malicious code in mimelib2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63ffee5ddddfafc58e3b65b97a362d842d02a6284d4d51de3c6dcce98b7eb1cd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6376 Malicious code in vite-log-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e278049c2919582d9fdb72033c214b715cd3cf34a0a80051a894185c4f669207 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6375 Malicious code in vanilla-cacher (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a170174d56e5363e8c8a3d47eb94f80f3b3dc18a2bf2240e372730ffe076ca97 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6373 Malicious code in redux-eslint-saga (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d08211092766c0313df71f1e2fe6fa8cf606e4f36570679a1391bda0a5dfd6e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6370 Malicious code in react-icon-maker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 46dc16e0765ddb06bcc46c49b58deba17ff9d4fce6cc5b65ebba0f617cf44fed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6363 Malicious code in json-confs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aeb598462f7d5aa755a41083007142a93c31fc7a61b70ea43c88dcefdd53025f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6377 Malicious code in vite-plugin-reactjs-refresh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4abf589cdec43e8ba609988d38155d5965b59ac6a83b1d251405fdf13629cdce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6353 Malicious code in @kodane/patch-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b7695fde6cc3a35bd130bcdcc096ef89e7ce312c36cd9e0a15ec986d9f516873 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6347 Malicious code in yaetia (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d95f6b127a40fcc4c4557dc3e26a11a6136d8837c28b9a32663f3a7a14a1c13 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...