MAL-2025-2515 Malicious code in micropilot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dfd0cfe335da0d48c9b22437f9ef4eee817052ac3d511a715998df91ca0b287f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability

tj-actions/changed-files GitHub Action contains an embedded malicious code vulnerability that allows a remote attacker to discover secrets by reading Github Actions Workflow Logs. These secrets may include, but are not limited to, valid AWS access keys, GitHub personal access tokens PATs, npm...

The vulnerability of the tpm2_seal_trusted() function in the security/keys/trusted-keys/trusted_tpm2.c file of the Linux kernel allows a hacker to trigger a service failure.

The vulnerability of the tpm2sealtrusted function in the security/keys/trusted-keys/trustedtpm2.c file of the Linux kernel is related to code errors. Exploiting this vulnerability could allow an attacker to trigger a service failure...

thunderbird: Downloading of OpenPGP keys from WKD used incorrect padding

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: When requesting an OpenPGP key from a WKD server, an incorrect padding size was used, and a network observer could have learned the length of the requested email address...

MAL-2025-2472 Malicious code in ramp-tax-info-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0679be505671452e55b48549ce4c786016851ea54330a9bad829775f5c786c1a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Fortinet FortiSandbox 安全漏洞

Fortinet FortiSandbox is an APT Advanced Persistent Threat protection appliance from Fortinet. The appliance offers dual sandboxing technology, dynamic threat intelligence system, real-time control panel and reporting. Fortinet FortiSandbox suffers from a security vulnerability that stems from th...

CVE-2025-29780 Post-Quantum Secure Feldman's Verifiable Secret Sharing has Timing Side-Channels in Matrix Operations

Post-Quantum Secure Feldman's Verifiable Secret Sharing provides a Python implementation of Feldman's Verifiable Secret Sharing VSS scheme. In versions 0.8.0b2 and prior, the feldmanvss library contains timing side-channel vulnerabilities in its matrix operations, specifically within the...

CVE-2024-13773

The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 via hard-coded credentials. This makes it possible for unauthenticated attackers to extract sensitive data including Linked...

An issue was discovered in uriparser through 0.9.7. ComposeQueryEngine in UriQuery.c has an integer overflow via long keys or values, with a resultant buffer overflow.

...

MAL-2025-2369 Malicious code in core-pino (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5db7bd8a50f90b0c2bda2716a859031b731da7ec6f2a6bdb9ebe567eb5b042ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2377 Malicious code in dingpengtest-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 325da1087c6b9a78d54fd2d9d92270a587831c91eda6e1620e828bd0a9eea080 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2358 Malicious code in airbnb-jitney-schemas (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8d76706b4f731a72f676dcad6dd407e8944420bf6d13444362341eceb7adbac2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2422 Malicious code in tfjs-layers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 01a2e2a8e8d3d2e521a17fe1f820c031a83b9a0b1a45819059fba2bc47348f98 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2401 Malicious code in process-tick (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8116c15eee956d7e82aa0fb093ae7d010310e9ca155a99918732c04ef0114922 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in epic-debug (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d79b6f53b73a42bf490549818051758b4fafca55d32e9d85060712adfa1b5e2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

TikTok: Stored XSS on TikTok's backend leads to the leakage of highly sensitive administrator data (Cookies, API Keys, Internal Paths, Emails, phone numbers).

A stored cross-site scripting vulnerability was discovered in TikTok's contact form backend. Malicious code submitted through the form executed when administrators viewed the submission, exposing sensitive internal data such as cookies, API keys, internal paths, emails, and phone numbers...

MAL-2025-2409 Malicious code in remix-run-route (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a5399b923491b48948c89e6e1e30d9d3028f6bb8db3bdc9f8d48b513a879ac1c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2410 Malicious code in request-draft-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e20e7c9b27e44bc6a2f406fc1638d5949e6a8ff79801714031432723b004872d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2399 Malicious code in plz-bas-ek-bar-dilado-batman (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fa8be0f4474626ccd60533895a89a14daacd056083e7ec492f5015b7bd84741d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress plugin Civi 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...