Malicious code in supply_chain_dummy_test_2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed3f5fef388376bf388c291f40ce96d8431d31f38fb29b6f69b6543408d9ef2f The package supplychaindummytest2 was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-204849

LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs...

GHSA-C67J-W6G6-Q2CM LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs

Summary A serialization injection vulnerability exists in LangChain's dumps and dumpd functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries. The 'lc' key is used internally by LangChain to mark serialized objects. When user-controlled data...

Malicious code in dotjsenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 199e0e242516cf235f3d4f4d7b7921f7b52573e674bd76da515939782a81c153 The package dotjsenv was found to contain malicious code. Source: ghsa-malware b4dd239728dde802ec7a7aadd85d2a9f1c5c3e8b83e5f19b92a2afab16d1cd1c Any...

Malicious code in qxytest1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0505d10da1308ac438dd0f500c125f12d4256deda46cca7991289eee22897d53 The package qxytest1 was found to contain malicious code. Source: ghsa-malware a5c4713032b22949ba57f3363cbced03d097646105ff09ef45dec3b09d552cae Any...

Improper Authentication

github.com/edgelesssys/contrast is vulnerable to Improper Authentication. The vulnerability is due to unauthenticated LUKS2 volume metadata and support for null key-encryption algorithms, which allows an attacker to craft a malicious volume that opens with any passphrase and captures all written...

SemCovert: Secure and Covert Video Transmission Via Deep Semantic-Level Hiding

Video semantic communication, praised for its transmission efficiency, still faces critical challenges related to privacy leakage. Traditional security techniques like steganography and encryption are challenging to apply since they are not inherently robust against semantic-level transformations...

Malicious code in secguest-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae83c0c9ae4ffab006e7b6d1833b54dfb5386dedf3e94dedf500b3af1dc82d1c The package secguest-lib was found to contain malicious code. Source: ghsa-malware 62ef36b4b0912fdc42b94702acf5c8e48b06cb2d3370113c3c875479aacd5e9f A...

📄 Headlamp 0.38.0 Unauthenticated Cached Credentials Access

Proof of concept exploit for a flaw in Headlamp Kubernetes dashboard versions 0.38.0 and below that allows unauthenticated users to access sensitive Helm release data, including secrets, tokens, and passwords, due to improper server-side caching...

CVE-2023-53951

Ever Gauzy v0.281.9 contains a JWT authentication vulnerability that allows attackers to exploit weak HMAC secret key implementation. Attackers can leverage the exposed JWT token to authenticate and gain unauthorized access with administrative permissions...

EUVD-2025-204596

Ever Gauzy v0.281.9 contains a JWT authentication vulnerability that allows attackers to exploit weak HMAC secret key implementation. Attackers can leverage the exposed JWT token to authenticate and gain unauthorized access with administrative permissions...

CVE-2023-53951 Ever Gauzy v0.281.9 JWT Authentication Weakness via HMAC Secret

Ever Gauzy v0.281.9 contains a JWT authentication vulnerability that allows attackers to exploit weak HMAC secret key implementation. Attackers can leverage the exposed JWT token to authenticate and gain unauthorized access with administrative permissions...

CVE-2023-53951 Ever Gauzy v0.281.9 JWT Authentication Weakness via HMAC Secret

Ever Gauzy v0.281.9 contains a JWT authentication vulnerability that allows attackers to exploit weak HMAC secret key implementation. Attackers can leverage the exposed JWT token to authenticate and gain unauthorized access with administrative permissions...

CVE-2023-53951

CVE-2023-53951 concerns Ever Gauzy v0.281.9, where a weak HMAC secret in the JWT authentication implementation allows forging tokens to authenticate with administrative permissions. The vulnerability is evidenced across multiple sources (including Red Hat, NVD/CNNVD-type records, CIRCL sightings,...

CVE-2023-53951 Ever Gauzy v0.281.9 JWT Authentication Weakness via HMAC Secret

Ever Gauzy v0.281.9 contains a JWT authentication vulnerability that allows attackers to exploit weak HMAC secret key implementation. Attackers can leverage the exposed JWT token to authenticate and gain unauthorized access with administrative permissions...

MAL-2025-192674 Malicious code in xnetgpt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cec426261ce30ea326ac55c56aaaf04c8efc5dad86f9eecaf8a8397df70dec7 The package xnetgpt was found to contain malicious code. Source: ghsa-malware 168c69e604f23926993c52e06b6a5f4b5355d3dd935261e5aba8c5d761bb17e1 Any...

MAL-2025-192660 Malicious code in @sodexo-connect/sap-cdc-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4e047fc494b2206648c16c1e980cbf3aed51b9c27a8a9287cabfa869aab9095 The package @sodexo-connect/sap-cdc-client was found to contain malicious code. Source: ghsa-malware...

Malicious code in xmlwtf3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdc397291400d5d396c50c42966b6c482fb92a577a17ad2440c2ab4c7f0619e6 The package xmlwtf3 was found to contain malicious code. Source: ghsa-malware f1aef41363b46dac1d30ba3bd916904df95fce8278f6b3abed14f7b48002d2c8 Any...

MAL-2025-192673 Malicious code in xmlwtf3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdc397291400d5d396c50c42966b6c482fb92a577a17ad2440c2ab4c7f0619e6 The package xmlwtf3 was found to contain malicious code. Source: ghsa-malware f1aef41363b46dac1d30ba3bd916904df95fce8278f6b3abed14f7b48002d2c8 Any...

MAL-2025-192667 Malicious code in ctfvampir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7326c736b63690c5699af7e755bf0f5fa0663dcfc80c27ae252c7f8b9d57c47 The package ctfvampir was found to contain malicious code. Source: ghsa-malware 20527b160a7dde628dd4ce3ca417fd8a0977612133c8b1a443cdbe9496efb604 Any...