Malicious code in mdx-oauth-google-quark (npm)

The package mdx-oauth-google-quark was found to contain malicious code...

MAL-2025-33573 Malicious code in soap-gravity-jsonp-oauth (npm)

The package soap-gravity-jsonp-oauth was found to contain malicious code...

MAL-2025-23609 Malicious code in janus-meteor-toml-oauth (npm)

The package janus-meteor-toml-oauth was found to contain malicious code...

MAL-2025-26075 Malicious code in mdx-oauth-google-quark (npm)

The package mdx-oauth-google-quark was found to contain malicious code...

MAL-2025-27636 Malicious code in node-oauth-walkthrough (npm)

The package node-oauth-walkthrough was found to contain malicious code...

MAL-2025-26871 Malicious code in mui-sagitta-comet-oauth (npm)

The package mui-sagitta-comet-oauth was found to contain malicious code...

MAL-2025-28020 Malicious code in oauth-walkthrough (npm)

The package oauth-walkthrough was found to contain malicious code...

MAL-2025-16409 Malicious code in bytel-oauth (npm)

The package bytel-oauth was found to contain malicious code...

MAL-2025-24350 Malicious code in kaus-oauth-chakra-ui-membrane (npm)

The package kaus-oauth-chakra-ui-membrane was found to contain malicious code...

CVE-2025-54382

Cherry Studio (desktop client) version 1.5.1 is affected by an RCE vulnerability when connecting to streamableHttp MCP servers due to the server’s implicit trust in OAuth redirection URLs and improper URL sanitization. The issue is mitigated by upgrading to version 1.5.2. Exploitation status is n...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: mattermost-fips, amazon-ssm-agent-fips, aws-nuke, postgres-operator, karpenter-fips, gitlab-cng, aws-flb-kinesis, harbor-registry, kpt, k8s-device-plugin, kyverno-policy-reporter-kyverno-plugin-fips, nri-mysql, helm-operator, skaffold, crossplane-provider-azure-sql,...

Malicious code in react-native-kraken-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6dd9f629078cdad7b927b9f85f1d8b3a5d381a6009e08c65eafca6272b20cbf2 The OpenSSF Package Analysis project identified 'react-native-kraken-oauth' @ 1.0.1 npm as malicious. It is considered malicious because: - The...

MAL-2025-6806 Malicious code in react-native-kraken-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6dd9f629078cdad7b927b9f85f1d8b3a5d381a6009e08c65eafca6272b20cbf2 The OpenSSF Package Analysis project identified 'react-native-kraken-oauth' @ 1.0.1 npm as malicious. It is considered malicious because: - The...

PT-2025-32408 · Unknown · Zlt2000 Microservices-Platform

Name of the Vulnerable Software and Affected Versions: zlt2000 microservices-platform versions through 6.0.0 Description: A problematic issue exists in zlt2000 microservices-platform. The issue is related to an open redirect vulnerability within the onLogoutSuccess function located in the file...

WakaTime: Double Clickjacking Attack on WakaTime OAuth Authorization Flow at https://wakatime.com/oauth/authorize

The WakaTime OAuth authorization flow was vulnerable to a double-clickjacking attack. The attack allowed an attacker to trick users into unknowingly clicking the "Connect my WakaTime account" button in the consent dialog, enabling the attacker to register an OAuth application, capture the...

Attackers Use Fake OAuth Apps with Tycoon Kit to Breach Microsoft 365 Accounts

Cybersecurity researchers have detailed a new cluster of activity where threat actors are impersonating enterprises with fake Microsoft OAuth applications to facilitate credential harvesting as part of account takeover attacks. "The fake Microsoft 365 applications impersonate various companies,...

CVE-2025-6505

Unauthorized access and impersonation can occur in versions 4.6.2.3226 and below of Progress Software's Hybrid Data Pipeline Server on Linux. This vulnerability allows attackers to combine credentials from different sources, potentially leading to client impersonation and unauthorized access. Whe...

ROS-20250731-01

Vulnerability in the implementation of OAuth request signing logic for Python OAuthLib is due to insufficient user data validation in urivalidate functions. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...

CVE-2025-54529

In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integration...

CVE-2025-6505

Unauthorized access and impersonation can occur in versions 4.6.2.3226 and below of Progress Software's Hybrid Data Pipeline Server on Linux. This vulnerability allows attackers to combine credentials from different sources, potentially leading to client impersonation and unauthorized access. Whe...