CVE-2025-5981 Arbitrary File write in OSV-SCALIBR

Arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR's unpack function for container images. Particularly, when using the CLI flag --remote-image on untrusted container images...

PT-2025-25778

Name of the Vulnerable Software and Affected Versions OSV-SCALIBR affected versions not specified Description The issue allows for arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR's unpack function for container images. This...

CVE-2025-5981: Uncontrolled Search Path Element

Arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR's unpack function for container images. Particularly, when using the CLI flag --remote-image on untrusted container images...

@env-hopper/backend-core (>=2.0.1-alpha-20260224145405, <=3.0.0-alpha-20260929191308), @env-hopper/frontend-core (>=2.0.1-alpha, <=3.0.0-alpha-20260929191308) +4 more potentially affected by CVE-2025-48054 via radashi (12.5.0-beta.6d5c035)

radashi NPM version 12.5.0-beta.6d5c035 is affected by a known vulnerability. The following packages have a transitive dependency on radashi and may be impacted: - @env-hopper/backend-core =2.0.1-alpha-20260224145405, =2.0.1-alpha, =2.0.1-alpha-20260224145405, =0.0.1, =0.0.1, =0.0.1,...

3llm (0.0.1), @abuaiman/abujunainah (1.1.4) +370 more potentially affected by CVE-2025-32421 via next (>=15.0.0, <=15.1.5)

next NPM version =15.0.0, =0.0.3-alpha-20241021184442-252a149a89c221b28ae459807869535922e67185, =1.0.19, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.1.0, =0.0.4, =0.1.0, =0.1.20 and more Source cves: CVE-2025-32421 Source advisory: OSV:GHSA-QPJV-V59X-3QC4...

OSV-2025-326 Heap-use-after-free in __JS_FreeValueRT

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=415361008 Crash type: Heap-use-after-free WRITE 8 Crash state: JSFreeValueRT JSCallInternal JSEvalFunctionInternal...

audio-video-metadata (>=0.1.0, <=0.1.7), fselect (>=0.3.2, <=0.8.11) +1 more potentially affected by unknown CVE via mp3-metadata (>=0.1.1, <=0.3.4)

mp3-metadata CARGO version =0.1.1, =0.1.0, =0.3.2, =0.1.0, =0.2.2 Source cves: unknown CVE Source advisory: OSV:GHSA-927Q-G9W9-PM54...

a3mo_lib (>=0.1.0, <=0.1.1), abra (0.0.1) +3840 more potentially affected by unknown CVE via rustc-serialize (>=0.1.5, <=0.3.25)

rustc-serialize CARGO version =0.1.5, =0.1.0, =0.1.7, =0.0.6, =0.1.0, =0.2.1, =0.1.4, =0.1.1, =0.1.0, =0.1.0, =0.3.3, =0.1.0, =0.2.1, =0.7.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0025...

@compas/server (>=0.0.219, <=0.17.0), @eamic/server (>=1.0.1, <=1.0.3) +23 more potentially affected by CVE-2025-46653 via formidable (>=2.1.1, <=2.1.2)

formidable NPM version =2.1.1, =0.0.219, =1.0.1, =3.0.0-alpha.21, =1.0.10, =1.8.8, =0.141.0, =0.0.219, =1.13.0, =1.0.9, =1.3.15, =0.1.0, =0.21.7, =0.1.0, =1.1.0 and more Source cves: CVE-2025-46653 Source advisory: OSV:GHSA-75V8-2H7P-7M2M...

aabb_physics (>=0.1.0, <=0.1.1), acolor (>=0.0.2, <=0.0.11) +117 more potentially affected by unknown CVE via macroquad (>=0.2.9, <=0.4.16)

macroquad CARGO version =0.2.9, =0.1.0, =0.0.2, =0.1.0, =0.1.0, =0.1.0, =0.0.4, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.3 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0035...

A Time Series Analysis of Malware Uploads to Programming Language Ecosystems

Software ecosystems built around programming languages have greatly facilitated software development. At the same time, their security has increasingly been acknowledged as a problem. To this end, the paper examines the previously overlooked longitudinal aspects of software ecosystem security,...

@adhd/backlog (>=1.0.0, <=1.0.17), @adhd/dispatch-cli (>=0.1.6, <=0.1.9) +440 more potentially affected by CVE-2025-32395 via vite (>=5.0.0, <=5.4.17)

vite NPM version =5.0.0, =1.0.0, =0.1.6, =2.2.1, =0.0.1, =0.7.9, =4.23.1-prerelease.0, =17.1.0-next.0, =18.0.0-next.3, =1.0.25-beta.0, =0.0.1-alpha.0, =0.5.0, =0.5.5 - @avorati/strapi-plugin-preview 1.0.1 - @beaker-tools/typescript-toolkit 1.3.0 and more Source cves: CVE-2025-32395 Source advisor...

@genesisx/graphql (>=3.0.0-beta.1, <=4.0.1), @genesisx/graphql-utils (>=3.0.0-beta.0, <=3.0.1) +9 more potentially affected by CVE-2025-32031 via @apollo/gateway (>=2.0.0-preview.2, <=2.10.0)

@apollo/gateway NPM version =2.0.0-preview.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.11.46-alpha-bad726532.0, =0.0.1, =8.6.7, =2.8.54, =0.0.0-preview-20220428090254, =0.0.0-preview-20221125005457, =1.3.3, =0.0.3, =1.0.48 - nestjs-registry 0.0.1 Source cves: CVE-2025-32031 Source advisory:...

OSV-2025-262 UNKNOWN WRITE in _lou_handlePassVariableAction

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=408523839 Crash type: UNKNOWN WRITE Crash state: louhandlePassVariableAction passDoAction translateString...

gitoxide (>=0.1.0, <=0.15.0) potentially affected by CVE-2025-31130 via gitoxide-core (>=0.1.0, <=0.17.0)

gitoxide-core CARGO version =0.1.0, =0.1.0, =0.15.0 Source cves: CVE-2025-31130 Source advisory: OSV:GHSA-2FRX-2596-X5R6...

@directus/api (>=15.0.0, <=24.0.1), @linotype/directus-extension-linotype (>=1.2.2, <=1.3.5) +8 more potentially affected by CVE-2025-30353 via directus (>=9.21.2, <=11.4.1)

directus NPM version =9.21.2, =15.0.0, =1.2.2, =0.1.0, =1.0.0, =1.0.1, =1.0.0, =1.0.75 - nuxtus-server 1.0.0 Source cves: CVE-2025-30353 Source advisory: OSV:GHSA-FM3H-P9WM-H74H...

addr2line (>=0.1.0, <=0.3.0), ai4ose-tg-rcore-tutorial-ch8-doom (0.1.0-preview.1) +139 more potentially affected by unknown CVE via xmas-elf (>=0.3.0, <=0.9.1)

xmas-elf CARGO version =0.3.0, =0.1.0, =0.1.4, =0.1.0, =0.1.0, =0.1.1, =0.11.0-beta, =0.1.0-alpha.0, =0.1.0-alpha.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.0, =0.0.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0018...

GHSA-265R-HFXG-FHMG vulnerabilities

Vulnerabilities for packages: k3s, wolfictl, envoy-gateway, kubevela, buildkitd, kaniko, flux-source-controller, neuvector-scanner, xeol, rancher-fleet, grype, nerdctl, cilium-cli, kargo, syft, zot, k8ssandra-client, kots, docker-compose, cluster-api-helm-controller, zarf, melange, helm-push,...

@firedesktop/react-portal-base (0.1.46), svgedit (7.3.5) potentially affected by CVE-2025-29907 via jspdf (3.0.0)

jspdf NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on jspdf and may be impacted: - @firedesktop/react-portal-base 0.1.46 - svgedit 7.3.5 Source cves: CVE-2025-29907 Source advisory: OSV:GHSA-W532-JXJH-HJHJ...

@amcharts/amcharts4 (4.9.21), @anarmawala/vite-plugin-icons (>=0.1.0, <=0.1.1) +58 more potentially affected by CVE-2025-25977 via canvg (>=3.0.0, <=3.0.10)

canvg NPM version =3.0.0, =0.1.0, =1.13.6, =0.2.2, =1.31.0, =1.19.0, =1.0.0, =8.5.1-beta, =0.1.0, =0.1.2, =10.0.1, =10.0.1, =2.0.4, =0.1.4, =0.1.5 and more Source cves: CVE-2025-25977 Source advisory: OSV:GHSA-V2MW-5MCH-W8C5...