alemat (>=0.3.0, <=0.8.0), box-bin (0.3.1) +16 more potentially affected by unknown CVE via unic-ucd (>=0.5.0, <=0.9.0)

unic-ucd CARGO version =0.5.0, =0.3.0, =0.3.0, =0.0.0, =0.0.102, =0.0.7, =0.0.1, =1.0.0, =1.11.3, =0.1.0, =0.0.0, =0.1.0, =0.5.0, =0.7.0, =0.9.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0077...

audio-processor-analysis (>=0.1.0-alpha.4, <=0.1.0-alpha.9), chalkboard (0.1.0) +66 more potentially affected by unknown CVE via unic-bidi (>=0.1.0, <=0.9.0)

unic-bidi CARGO version =0.1.0, =0.1.0-alpha.4, =0.4.0, =0.7.0, =0.4.0, =0.7.0, =0.8.3 - druid-ui 0.0.1 - druid-widget-nursery 0.1.0 - druidtask1 0.1.0 - ellisia 0.0.0 - ezel 0.0.1 - frui 0.0.1 - fruicore 0.0.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0096...

doge_dns (>=0.2.4-beta, <=1.0.2), rev-up-your-harley (>=0.1.0, <=1.0.1) +4 more potentially affected by unknown CVE via unic-idna-mapping (>=0.4.0, <=0.9.0)

unic-idna-mapping CARGO version =0.4.0, =0.2.4-beta, =0.1.0, =0.1.0, =0.5.0, =0.7.0, =0.4.0, =0.9.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0097...

@aem-screens/franklin-variation-creator (1.0.0-B001), @akord/ui (>=3.4.1, <=3.15.4) +178 more potentially affected by CVE-2025-11849 via mammoth (>=0.3.33, <=1.10.0)

mammoth NPM version =0.3.33, =3.4.1, =0.0.1, =1.0.0, =0.0.9, =0.1.5, =1.2.1, =1.4.2, =1.0.34, =1.2.1-a, =1.0.0, =1.2.2, =0.0.7, =0.2.5 and more Source cves: CVE-2025-11849 Source advisory: OSV:GHSA-RMJR-87WV-GF87...

tom-microservice (3.2.28) potentially affected by CVE-2025-62380 via mailgen (2.0.20)

mailgen NPM version 2.0.20 is affected by a known vulnerability. The following packages have a transitive dependency on mailgen and may be impacted: - tom-microservice 3.2.28 Source cves: CVE-2025-62380 Source advisory: OSV:GHSA-Q4W9-X3RV-4C8J...

OSV-2025-824 Use-of-uninitialized-value in JS_DefineProperty

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=449772271 Crash type: Use-of-uninitialized-value Crash state: JSDefineProperty buildbacktrace JSCallInternal...

EUVD-2025-18630

Malicious code in bioql PyPI...

mysticcelestial (1.0.1) potentially affected by CVE-2025-61668 via @plone/volto (18.10.1)

@plone/volto NPM version 18.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on @plone/volto and may be impacted: - mysticcelestial 1.0.1 Source cves: CVE-2025-61668 Source advisory: OSV:GHSA-M8RJ-PPPH-MJ33...

@remirror/core (>=0.2.0, <=0.11.0), @remirror/core-extensions (>=0.2.0, <=0.13.1) +42 more potentially affected by CVE-2025-57352 via min-document (>=2.17.0, <=2.19.0)

min-document NPM version =2.17.0, =0.2.0, =0.2.0, =0.4.2-ci.1569229282.9, =0.4.2-canary.2, =0.4.2-ci.1569229282.9, =0.4.2-ci.1569229282.9, =0.2.0, =0.2.0, =0.2.0, =0.4.0, =0.4.2-ci.1569229282.9, =0.2.0, =0.2.0, =0.2.0, =0.4.2-ci.1569229282.9, =0.13.1 and more Source cves: CVE-2025-57352 Source...

tom-microservice (3.2.28) potentially affected by CVE-2025-59526 via mailgen (2.0.20)

mailgen NPM version 2.0.20 is affected by a known vulnerability. The following packages have a transitive dependency on mailgen and may be impacted: - tom-microservice 3.2.28 Source cves: CVE-2025-59526 Source advisory: OSV:GHSA-J2XJ-H7W5-R7VP...

marked-sanitizer (0.0.0) potentially affected by unknown CVE via ammonia (3.1.4)

ammonia CARGO version 3.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on ammonia and may be impacted: - marked-sanitizer 0.0.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0071...

better-config-loader (>=0.1.4, <=0.2.4), chio-config (0.1.0) +67 more potentially affected by unknown CVE via serde_yml (>=0.0.7, <=0.0.12)

serdeyml CARGO version =0.0.7, =0.1.4, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.14.0, =0.14.0, =0.3.0, =1.0.0, =0.1.29, =0.1.31 - dendryform 0.1.0 - dendryform-ascii 0.1.0 - dendryform-core 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-HHW4-XG65-FP2X...

archivefs (>=1.0.0, <=1.0.1), arcon_compiler (>=0.1.0, <=0.1.1) +35 more potentially affected by unknown CVE via daemonize (>=0.2.3, <=0.5.0)

daemonize CARGO version =0.2.3, =1.0.0, =0.1.0, =0.2.0, =0.5.0, =3.0.0, =0.1.2, =0.0.1, =1.5.5, =0.1.0, =14.2.0-snapshot, =0.6.0, =0.3.0-rc.1, =0.2.0, =0.2.2 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0069...

better-config-loader (>=0.1.4, <=0.2.4), chio-config (0.1.0) +68 more potentially affected by unknown CVE via libyml (>=0.0.1, <=0.0.5)

libyml CARGO version =0.0.1, =0.1.4, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.14.0, =0.14.0, =0.3.0, =1.0.0, =0.1.29, =0.1.31 - dendryform 0.1.0 - dendryform-ascii 0.1.0 - dendryform-core 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0067...

@angularexpert/my-workspace (0.0.0), @cosla/sensemaking-web-ui (>=1.0.0, <=1.0.4) +47 more potentially affected by CVE-2025-59052 via @angular/platform-server (>=16.2.12, <=18.2.13)

@angular/platform-server NPM version =16.2.12, =1.0.0, =0.0.1, =1.4.1, =1.1.1, =0.1.0, =13.1.0, =0.0.0, =2.1.0, =0.0.2, =0.0.11 and more Source cves: CVE-2025-59052 Source advisory: OSV:GHSA-68X2-MX4Q-78M7...

accesskit_windows (>=0.5.0, <=0.10.4), accesskit_winit (>=0.2.0, <=0.8.1) +284 more potentially affected by unknown CVE via servo-fontconfig (>=0.4.0, <=0.5.1)

servo-fontconfig CARGO version =0.4.0, =0.5.0, =0.2.0, =0.5.0, =0.5.0, =0.1.0, =0.8.0, =0.8.0, =0.4.0, =0.6.0, =0.12.7, =0.19.3, =0.3.0, =0.3.5 - ash-tray 0.19.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0059...

aa2nucaln (0.1.1), agent-stream-kit (>=0.9.0, <=0.14.0) +373 more potentially affected by unknown CVE via custom_derive (0.1.7)

customderive CARGO version 0.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on customderive and may be impacted: - aa2nucaln 0.1.1 - agent-stream-kit =0.9.0, =0.4.0, =0.1.1, =0.2.0, =0.1.0, =0.1.0, =3.1.3, =0.3.7, =0.1.0, =0.1.0, =0.1.2 and more Sour...

a2d (>=0.1.0, <=0.1.11), abscissa (>=0.6.0-beta.1, <=0.6.0-rc.0) +1101 more potentially affected by unknown CVE via adler (>=0.2.3, <=1.0.2)

adler CARGO version =0.2.3, =0.1.0, =0.6.0-beta.1, =0.6.0-beta.1, =0.6.0-beta.1, =0.1.5, =0.0.1-dev.10, =0.4.0, =0.2.0, =0.1.0, =0.2.0, =0.1.13, =0.1.0, =0.3.0, =0.1.0, =0.9.1, =0.13.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0056...

@jill64/svelte-dark-theme (>=2.3.65, <=5.1.7), @jill64/svelte-i18n (>=1.1.27, <=2.2.1) +9 more potentially affected by CVE-2025-57820 via devalue (>=5.0.0, <=5.1.1)

devalue NPM version =5.0.0, =2.3.65, =1.1.27, =1.1.21, =1.2.263, =2.2.3, =0.0.2-dev.84, =1.0.23, =1.0.22, =1.0.0, =1.0.6, =2.1.10, =2.1.15 Source cves: CVE-2025-57820 Source advisory: OSV:GHSA-VJ54-72F3-P5JV...

OSV-2025-684 Heap-buffer-overflow in TGAHandler::read

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=440585455 Crash type: Heap-buffer-overflow WRITE 4 Crash state: TGAHandler::read kimgiofuzzer.cc...