OSV-2025-154 UNKNOWN READ in ndpi_strdup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=398060128 Crash type: UNKNOWN READ Crash state: ndpistrdup processndpicollectedinfo nodecleanupwalker...

PT-2025-7647

Name of the Vulnerable Software and Affected Versions OSV affected versions not specified Description The issue allows an attacker to view sensitive information even after they are no longer logged into the account due to improper cache control. This poses a significant risk to user privacy and...

@directus/api (>=22.0.0, <=23.0.0) potentially affected by CVE-2025-27089 via directus (>=11.0.0, <=11.1.1)

directus NPM version =11.0.0, =22.0.0, =23.0.0 Source cves: CVE-2025-27089 Source advisory: OSV:GHSA-99VM-5V2H-H6R6...

0x-relayer-cat (>=0.0.2, <=0.0.10), 0xauth (>=0.0.2, <=0.0.6) +8230 more potentially affected by unknown CVE via elliptic (>=6.0.2, <=6.6.0)

elliptic NPM version =6.0.2, =0.0.2, =0.0.2, =1.0.6-beta.1, =0.0.1-beta.1, =0.1.0, =0.0.92, =0.1.3, =4.2.1, =6.2.1, =13.6.1, =13.7.2 and more Source cves: unknown CVE Source advisory: OSV:GHSA-VJH7-7G9H-FJFH...

128981semzub (1.0.1), 1food-menu (>=0.0.1, <=0.3.8) +25221 more potentially affected by unknown CVE via esbuild (>=0.0.0, <=0.24.2)

esbuild NPM version =0.0.0, =0.0.1, =0.0.1, =1.0.0, =1.0.1, =0.1.0, =0.0.1, =0.0.4, =0.0.1, =1.0.0, =1.1.0 - 7qb-cli 2.0.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-67MH-4WV8-2F99...

datafu (>=0.0.6, <=0.0.7) potentially affected by unknown CVE via totally-safe-transmute (0.0.3)

totally-safe-transmute CARGO version 0.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on totally-safe-transmute and may be impacted: - datafu =0.0.6, =0.0.7 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0030...

@abaplint/database-snowflake (>=2.7.93, <=2.7.101), @altimateai/datamate (>=0.0.19-beta.2, <=0.4.4) +163 more potentially affected by CVE-2025-24791 via snowflake-sdk (>=1.13.1, <=1.15.0)

snowflake-sdk NPM version =1.13.1, =2.7.93, =0.0.19-beta.2, =0.0.5, =8.0.0, =1.8.0, =0.0.0, =0.4.4, =0.7.17, =0.0.2, =1.0.2, =1.0.93, =0.0.0-beta.1, =0.0.31, =0.0.1-beta.22, =0.0.30 and more Source cves: CVE-2025-24791 Source advisory: OSV:GHSA-XFHV-WQJ6-RX99...

@laboratory-one/api-components (>=0.0.16, <=0.0.21), @rxap/nest-sentry (>=10.4.5-dev.1, <=10.4.5) potentially affected by unknown CVE via @sentry/nestjs (>=8.18.0, <=8.26.0)

@sentry/nestjs NPM version =8.18.0, =0.0.16, =10.4.5-dev.1, =10.4.5 Source cves: unknown CVE Source advisory: OSV:GHSA-R5W7-F542-Q2J4...

acct (>=0.2.0, <=0.5.0), almel (>=1.0.0, <=1.4.7) +179 more potentially affected by CVE-2025-5791 via users (>=0.8.1, <=0.11.0)

users CARGO version =0.8.1, =0.2.0, =1.0.0, =0.1.0, =0.9.0, =0.9.0, =0.1.0, =0.9.0, =0.2.4, =0.1.0, =0.4.2, =0.4.0, =0.7.4, =0.1.4, =0.8.2, =0.8.3 and more Source cves: CVE-2025-5791 Source advisory: OSV:RUSTSEC-2025-0040...

accountnovafi (>=0.1.0, <=0.2.0), accountnovafi1 (0.1.0) +708 more potentially affected by unknown CVE via libsecp256k1 (>=0.1.3, <=0.7.2)

libsecp256k1 CARGO version =0.1.3, =0.1.0, =0.1.0, =1.0.5, =0.0.1, =0.0.1, =0.1.0, =0.0.1, =0.1.0, =0.3.0, =0.3.2, =0.3.3 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0161...

avery (>=0.1.0, <=0.7.1), bibjoin (>=0.1.2, <=0.2.1) +64 more potentially affected by unknown CVE via fast-float (0.2.0)

fast-float CARGO version 0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on fast-float and may be impacted: - avery =0.1.0, =0.1.2, =0.1.0, =0.13.0, =0.19.0, =0.4.1, =0.6.2, =0.3.2, =0.4.1, =0.3.2, =0.3.2, =0.1.0, =1.0.8, =1.1.0 and more Source cves...

airgorah (>=0.1.0, <=0.3.0), aki-image-view-gtk (>=0.2.9, <=0.2.10) +377 more potentially affected by unknown CVE via glib (>=0.15.12, <=0.19.9)

glib CARGO version =0.15.12, =0.1.0, =0.2.9, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.1.0, =0.1.0, =0.1.0, =0.8.0, =0.8.0, =0.2.0-beta-1, =0.3.2 - asyncuigtk 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-WRW7-89JP-8Q8G...

ifood2-github-io (9.9.9) potentially affected by unknown CVE via ifood-github-io (9.9.9)

ifood-github-io NPM version 9.9.9 is affected by a known vulnerability. The following packages have a transitive dependency on ifood-github-io and may be impacted: - ifood2-github-io 9.9.9 Source cves: unknown CVE Source advisory: OSV:MAL-2024-11879...

5c-2023 (>=1.0.88, <=1.0.317), 5c-angle (>=0.0.1, <=0.0.3) +4850 more potentially affected by CVE-2024-55565 via nanoid (>=4.0.0, <=5.0.8)

nanoid NPM version =4.0.0, =1.0.88, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.4 and more Source cves: CVE-2024-55565 Source advisory: OSV:GHSA-MWCW-C2X4-8C55...

boltchat (>=0.2.0, <=0.2.2), kanga-rpm-rs (0.7.0) +5 more potentially affected by CVE-2024-53856 via pgp (>=0.7.2, <=0.9.0)

pgp CARGO version =0.7.2, =0.2.0, =0.1.0, =0.3.0, =0.3.2 Source cves: CVE-2024-53856 Source advisory: OSV:GHSA-9RMP-2568-59RV...

boltchat (>=0.2.0, <=0.2.2), kanga-rpm-rs (0.7.0) +5 more potentially affected by CVE-2024-53856 via pgp (>=0.7.2, <=0.9.0)

pgp CARGO version =0.7.2, =0.2.0, =0.1.0, =0.3.0, =0.3.2 Source cves: CVE-2024-53856 Source advisory: OSV:RUSTSEC-2024-0447...

bpxe-bpmn-schema (0.1.2), companion-service (0.1.0) +30 more potentially affected by unknown CVE via linkme (>=0.1.6, <=0.2.10)

linkme CARGO version =0.1.6, =0.1.2, =0.1.0, =0.1.0, =0.0.2-alpha, =0.0.2-alpha, =0.1.0, =0.2.1, =0.2.3, =0.0.1, =0.13.4 - kaspa-perf-monitor 0.13.4 - melodium 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-F95P-4CV5-8W8X...

@3kles/3kles-coremongodb (>=1.2.3, <=1.3.1), @3kles/storagebox-common (1.0.3) +414 more potentially affected by CVE-2024-53900 via mongoose (>=6.0.1, <=6.13.4)

mongoose NPM version =6.0.1, =1.2.3, =2.0.1, =0.0.1-alpha.89, =0.0.1-alpha.89, =0.0.3, =1.0.5, =3.9.0, =1.0.9, =1.0.0-beta1, =1.4.5, =1.1.80, =0.0.1, =0.1.16 and more Source cves: CVE-2024-53900 Source advisory: OSV:GHSA-M7XQ-9374-9RVX...

1405-authtokens (>=1.0.1, <=1.0.5), 1405_logging (1.0.0) +4122 more potentially affected by CVE-2024-53900 via mongoose (>=3.6.2, <=5.13.22)

mongoose NPM version =3.6.2, =1.0.1, =1.0.7, =0.0.1, =0.0.2, =0.3.0, =0.0.1, =0.3.5, =0.2.0, =0.0.1, =1.0.16, =1.0.30, =1.0.95 and more Source cves: CVE-2024-53900 Source advisory: OSV:GHSA-M7XQ-9374-9RVX...

@alfaris/scratch-vm (1.0.0), @antv/g6 (>=5.0.0-beta.33, <=5.0.44) +83 more potentially affected by unknown CVE via hull.js (>=0.2.10, <=1.0.6)

hull.js NPM version =0.2.10, =5.0.0-beta.33, =5.1.12, =1.8.20, =1.0.2, =0.1.0, =0.0.1739797164641, =1.3.0, =0.1.0, =0.5.7, =1.0.0, =0.1.0-raspberrypifoundation.20210805151219, =1.0.0, =1.1.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-Q849-WXRC-VQRP...