MAL-2025-3826 Malicious code in defipulse-adapters (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14d5536c5f6bcb7069516bd2682ee50724915e891c5f1aa5c68ef38d32f9e2d3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3852 Malicious code in react-native-plugin-ms-adal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 361e4c6581b21fde6eeab43c3e36a75bd051771efd939b92cd3f82fbee601f6e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3841 Malicious code in my-worker-with-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cecbb57d34a074c40db552b59c6f1a08a5571d2a39cfdce21503791d9a563e31 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3850 Malicious code in passport-thecity (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware defb7627134320679ac575b55c8a7ef1fa8d74d48f00766173f0214a95905c3e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3812 Malicious code in aads-blog (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a5b029c1e1a78aa275e83e7921d7d5c50626b37543ad1031e6461707103b6c8b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3819 Malicious code in auth0-guardian-management-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4489a903f859c5e165cf70220daabaaad24a21cdb1705bd94dfddab893954e72 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3789 Malicious code in aiide-cur (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2f87105b04445846be4b509793882c19f03cc302b5a62c868a7f5bc603d6ca1a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Alibaba Cloud Linux 3 : 0043: tang (ALINUX3-SA-2024:0043)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2024:0043 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2023-1672: A race condition exists in the Tang...

Function Call With Incorrect Order of Arguments

Overview Affected versions of this package are vulnerable to Function Call With Incorrect Order of Arguments due to the incorrect handling of the SECRETKEYFALLBACKS configuration. An attacker can exploit this to sign sessions with stale keys, potentially impeding the transition to fresher keys...

GHSA-4GRG-W6V8-C28G Flask uses fallback key instead of current signing key

In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key. Signing is provided by the itsdangerous library. A list of keys can be passed, and it expects the last top key in the list to be the most...

Flask uses fallback key instead of current signing key

In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key. Signing is provided by the itsdangerous library. A list of keys can be passed, and it expects the last top key in the list to be the most...

AZL-77828 CVE-2025-47278 affecting package python-flask 1.1.1-4

Flask is a web server gateway interface WSGI web application framework. In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key. Signing is provided by the itsdangerous library. A list of keys can...

DEBIAN-CVE-2025-47278

Flask is a web server gateway interface WSGI web application framework. In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key. Signing is provided by the itsdangerous library. A list of keys can...

AZL-77831 CVE-2025-47278 affecting package python-flask 1.1.1-4

Flask is a web server gateway interface WSGI web application framework. In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key. Signing is provided by the itsdangerous library. A list of keys can...

UBUNTU-CVE-2025-47278

Flask is a web server gateway interface WSGI web application framework. In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key. Signing is provided by the itsdangerous library. A list of keys can...

CVE-2025-47278

CVE-2025-47278 affects Flask 3.1.0, where itsdangerous signing key handling constructs the key list in reverse, causing the last (oldest) key to be used for signing when key rotation is configured via SECRET_KEY_FALLBACKS. The result is signing sessions with stale keys, potentially hindering tran...

CVE-2025-47278 Flask uses fallback key instead of current signing key

Flask is a web server gateway interface WSGI web application framework. In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key. Signing is provided by the itsdangerous library. A list of keys can...

CVE-2025-47278 Flask uses fallback key instead of current signing key

Flask is a web server gateway interface WSGI web application framework. In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key. Signing is provided by the itsdangerous library. A list of keys can...

CVE-2025-47278 Flask uses fallback key instead of current signing key

Flask is a web server gateway interface WSGI web application framework. In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key. Signing is provided by the itsdangerous library. A list of keys can...

MAL-2025-3746 Malicious code in @myop/angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 09d18e218c125f2136d393c6ad530b4706001a8298c9040fa0745d6ad625faee Withdrawn Advisory This advisory has been withdrawn because @myop/angular is not malware. This link is maintained to preserve external references. Origin...