Malicious code in browser-sync-task-runner (npm)

The package browser-sync-task-runner was found to contain malicious code...

MAL-2025-16199 Malicious code in browser-sync-task-runner (npm)

The package browser-sync-task-runner was found to contain malicious code...

Malicious code in test_oversight_runner (npm)

The package testoversightrunner was found to contain malicious code...

Malicious code in casper-runner (npm)

The package casper-runner was found to contain malicious code...

Malicious code in buildkite-runner (npm)

The package buildkite-runner was found to contain malicious code...

MAL-2025-16330 Malicious code in buildkite-runner (npm)

The package buildkite-runner was found to contain malicious code...

MAL-2025-36708 Malicious code in test_oversight_runner (npm)

The package testoversightrunner was found to contain malicious code...

MAL-2025-16627 Malicious code in casper-runner (npm)

The package casper-runner was found to contain malicious code...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: paranoia, temporal-ui-server-fips, snyk-cli, azuredisk-csi, thanos, secrets-store-csi-driver-provider-azure, cortex, fluent-bit-plugin-loki, metrics-agent-fips, mc, argo-events-fips, minio-operator, sigstore-scaffolding-fips, kubernetes-dashboard-api-fips, gitea,...

BIT-APISIX-2025-27446 Apache APISIX Java Plugin Runner: Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges

Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIXjava-plugin-runner. Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges. This issue affects Apache APISIXjava-plugin-runner: from 0.2.0 through 0.5.0. Users are...

Apache Apisix elevation of privilege vulnerability (CNVD-2025-20873)

Apache Apisix is a cloud-native microservices API gateway service of the U.S. Apache Apache Foundation. The software is based on OpenResty and etcd to realize , with dynamic routing and plug-in hot loading , suitable for microservice system under the API management . An elevation of privilege...

Malicious code in ec2-github-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1c7ca0d5642601c1f68fbd89dabf82a89747d310ed0196ea76061981bed79fd3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5775 Malicious code in ec2-github-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1c7ca0d5642601c1f68fbd89dabf82a89747d310ed0196ea76061981bed79fd3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dependabot-ruleset-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf6203024b7b15e14f8667f837a351ecd9b34c2298117e781b04de05af28cdc9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Incorrect Permission Assignment for Critical Resource

Overview Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource due to improper assignment of permissions to the local listening file. An attacker can gain elevated privileges by accessing or modifying the file with insufficiently restricted...

CVE-2025-27446 Apache APISIX Java Plugin Runner: Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges

Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIXjava-plugin-runner. Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges. This issue affects Apache APISIXjava-plugin-runner: from 0.2.0 through 0.5.0. Users are...

CVE-2025-27446

CVE-2025-27446 affects Apache APISIX (java-plugin-runner) from version 0.2.0 through 0.5.0. The root cause is improper permissions on a local listening file, enabling a local attacker to elevate privileges. The issue’s impact is high (local, user-privilege escalation with high confidentiality/int...

Apache Apisix 安全漏洞

Apache Apisix is a cloud-native microservices API gateway service of the U.S. Apache Apache Foundation. The software is based on OpenResty and etcd to realize , with dynamic routing and plug-in hot loading , suitable for microservice system under the API management . An elevation of privilege...

PT-2025-28065 · Apache · Apache Apisix

Name of the Vulnerable Software and Affected Versions: Apache APISIXjava-plugin-runner versions 0.2.0 through 0.5.0 Description: The issue is related to incorrect permission assignment for critical resources in the Apache APISIX java-plugin-runner, allowing a local attacker to elevate privileges...

Arbitrary Command Injection

Overview Affected versions of this package are vulnerable to Arbitrary Command Injection via the erroneous implementation of the allowlist process. An attacker can gain unauthorized access to execute arbitrary shell commands by bypassing configured restrictions. This may result in exposure or...