MAL-2025-22426 Malicious code in higgs-bellatrix-resolvers-typeorm (npm)

The package higgs-bellatrix-resolvers-typeorm was found to contain malicious code...

MAL-2025-15805 Malicious code in blazar-comet-toml-resolvers (npm)

The package blazar-comet-toml-resolvers was found to contain malicious code...

MAL-2025-32133 Malicious code in resolvers-less-loader-fornax-castor (npm)

The package resolvers-less-loader-fornax-castor was found to contain malicious code...

MAL-2025-36754 Malicious code in tethys-singularitarianism-resolvers-quantum (npm)

The package tethys-singularitarianism-resolvers-quantum was found to contain malicious code...

MAL-2025-23091 Malicious code in impulse-cluster-gravitationalwave-resolvers (npm)

The package impulse-cluster-gravitationalwave-resolvers was found to contain malicious code...

MAL-2025-21913 Malicious code in greatfilter-resolvers-query-greatfilter (npm)

The package greatfilter-resolvers-query-greatfilter was found to contain malicious code...

Malicious code in jwt-convict-dependencies-resolvers (npm)

The package jwt-convict-dependencies-resolvers was found to contain malicious code...

Amazon Linux 2 : unbound (ALASUNBOUND-1.17-2025-005)

The version of unbound installed on the remote host is prior to 1.17.0-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2UNBOUND-1.17-2025-005 advisory. A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that...

unbound: Unbound Cache poisoning

A cache poisoning flaw was found in Unbound. Resolvers supporting EDNS Client Subnet ECS must segregate outgoing queries to accommodate different outgoing ECS information. This issue reopens resolvers to a birthday paradox attack, known as the Rebirthday Attack, which attempts to match the DNS...

UBUNTU-CVE-2025-5994

A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet ECS. Unbound is also vulnerable when compiled with ECS support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to...

DEBIAN-CVE-2025-5994

A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet ECS. Unbound is also vulnerable when compiled with ECS support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to...

CVE-2025-23204

API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Starting in version 3.3.8, a security check that gets called after GraphQl resolvers is always replaced by another one as there's no break in a clause. As this falls back to security, the impact is there only when...

CVE-2025-23204 GraphQl securityAfterResolver not called

API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Starting in version 3.3.8, a security check that gets called after GraphQl resolvers is always replaced by another one as there's no break in a clause. As this falls back to security, the impact is there only when...

MAL-2025-2175 Malicious code in hookform-resolvers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c03aa7176706f7dee9f4c1c8f7c4d645d4345a2a47865b7924eea6e8b47a8101 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in hookform-resolvers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c03aa7176706f7dee9f4c1c8f7c4d645d4345a2a47865b7924eea6e8b47a8101 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

OESA-2024-2422 sbt security update

sbt is the simple build tool for Scala and Java projects. Security Fixes: sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, IO.unzip allows writing of arbitrary file. This would have potential to overwrite /root/.ssh/authorizedkeys. Within sbt's main code...

[SECURITY] Fedora 41 Update: aardvark-dns-1.12.2-2.fc41

Authoritative DNS server for A/AAAA container records Forwards other request to configured resolvers. Read more about configuration in src/backend/mod.rs...

CVE-2023-28455

An issue was discovered in Technitium through 11.0.2. The forwarding mode enables attackers to create a query loop using Technitium resolvers, launching amplification attacks and causing potential DoS...

Amazon Linux 2 : bind (ALAS-2024-2625)

The version of bind installed on the remote host is prior to 9.11.4-26.P2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2625 advisory. The DNS message parsing code in named includes a section whose computational complexity is overly high. It does not cause problem...

GHSA-CFXW-4H78-H7FW DNSJava DNSSEC Bypass

Summary Records in DNS replies are not checked for their relevance to the query, allowing an attacker to respond with RRs from different zones. Details DNS Messages are not authenticated. They do not guarantee that - received RRs are authentic - not received RRs do not exist - all or any received...