MAL-2025-191041 Malicious code in @oku-ui/primitives (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48684386017546a6d1cc3afd6317d995fe7edc730db2789b79af9135d8f88191 The package @oku-ui/primitives was found to contain malicious code. Source: ghsa-malware...

Malicious code in react-native-fetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b96159f9c8f74a56ea1f03322401befd0e090840e21dff7d1cc37db649e8cd58 The package react-native-fetch was found to contain malicious code. Source: ghsa-malware...

Malicious code in stat-fns (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5395e07a1f1a743d77d42495c7eaf08cb0ced22a0b0883b53b5adf78beef28a The package stat-fns was found to contain malicious code. Source: ghsa-malware 6c2e197e85b015babcf3a2073e3f76b980a3ae924a49a20d9c1648c610d7d3c0 Any...

libssh: Incorrect Return Code Handling in ssh_kdf() in libssh

A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the sshkdf function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenl...

Malicious code in @asyncapi/php-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81619d0ddfa1696b71c550ba94be4ddbdaed53aaef37376f8024945422da51b5 The package @asyncapi/php-template was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190826 Malicious code in @strapbuild/react-native-perspective-image-cropper-2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5e2f74d9d1d21777c83aa98d57c78a19a6161665a8af16c87f380f0d5b8139e The package @strapbuild/react-native-perspective-image-cropper-2 was found to contain malicious code. Source: ghsa-malware...

Malicious code in @strapbuild/react-native-perspective-image-cropper-2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5e2f74d9d1d21777c83aa98d57c78a19a6161665a8af16c87f380f0d5b8139e The package @strapbuild/react-native-perspective-image-cropper-2 was found to contain malicious code. Source: ghsa-malware...

Malicious code in @ensdomains/dnssec-oracle-anchors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b164c0fb4c77df7a6c083be92efc82f833aaa660d50fbb1a0eea26b2388c65a6 The package @ensdomains/dnssec-oracle-anchors was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190753 Malicious code in @posthog/siphash (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06113daabd3bc99b8cdcc1c4641266cebd61a5f0f10df264b2f37c955a121c20 The package @posthog/siphash was found to contain malicious code. Source: ghsa-malware ed632d6b4db6b2f74973167d160350198cd9130da004e958f2f1d51d217e9c...

MAL-2025-190681 Malicious code in @trigo/atrix-postgres (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e14a54095c9b7bc146d414230ec3c364d9dfb381dd4554ec3003ac116e69824 The package @trigo/atrix-postgres was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190657 Malicious code in @asyncapi/generator-helpers (npm)

@asyncapi/generator-helpers version 1.1.1 was published as part of the "Miasma RAT" software supply-chain attack campaign identifier "miasma-train-p1" that compromised several widely used @asyncapi npm packages on 2026-07-14. The malicious code was injected using whitespace hiding: it is appended...

MAL-2025-190676 Malicious code in @postman/aether-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf4244dc3aeb4aeef61e6a25bf53dd406e67c8b3d33f710a91934f64a631ae69 The package @postman/aether-icons was found to contain malicious code. Source: ghsa-malware...

Apache Syncope 安全漏洞

Apache Syncope is the United States Apache Apache Foundation's set of open source digital identity management system for use in enterprise environments. The system supports identity management, role configuration and more. Apache Syncope has a trust management issue vulnerability that stems from...

PT-2025-47923

Name of the Vulnerable Software and Affected Versions Fluent Bit versions affected versions not specified Description The in http, in splunk, and in elasticsearch input plugins in Fluent Bit do not properly sanitize tag key inputs. An attacker who can access the network or write records to Splunk...

CVE-2025-11935 Forward Secrecy Violation in WolfSSL TLS 1.3

With TLS 1.3 pre-shared key PSK a malicious or faulty server could ignore the request for PFS perfect forward secrecy and the client would continue on with the connection using PSK without PFS. This happened when a server responded to a ClientHello containing pskdheke without a keyshare...

CVE-2025-13470

In RNP version 0.18.0 a refactoring regression causes the symmetric session key used for Public-Key Encrypted Session Key PKESK packets to be left uninitialized except for zeroing, resulting in it always being an all-zero byte array. Any data encrypted using public-key encryption in this release...

JLSEC-2025-232 Side channel in RSA key generation and operations (SSBleed, M-Step)

Vulnerability Mbed TLS's modular inversion routine and GCD routine are vulnerable to local timing attacks in a number of settings discussed below. These functions are used in RSA, making the following operations vulnerable in all configurations: - RSA key generation with any API mbedtlsrsagenkey...

UBUNTU-CVE-2025-13402

RNP PKESK Session Keys Generated as All-Zero...

wolfSSL 安全漏洞

wolfSSL CyaSSL is a small, portable embedded SSL programming library for use by embedded systems developers from wolfSSL, Inc. in the United States. A security vulnerability exists in wolfSSL CyaSSL, which stems from the fact that TLS 1.3 pre-shared keys may ignore PFS requests, potentially...

CVE-2025-12822

The WP Login and Register using JWT plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'mojwtgeneratenewapikey' function in all versions up to, and including, 3.0.0. This makes it possible for authenticated attackers, with Subscriber-level...