13132 matches found
MAL-2025-190509 Malicious code in react-confetti-modern (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97a195b8307abbf7a2b6a5d4bd82b65aaad0891e87788e11d1a934707180631c The package react-confetti-modern was found to contain malicious code. Source: ghsa-malware...
MAL-2025-190501 Malicious code in tailwind-styled-scrollbar (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac987129deefb5aef175dc25c742373acfa189bdb1511017f6fff95a99e9ceb9 The package tailwind-styled-scrollbar was found to contain malicious code. Source: ghsa-malware...
PT-2025-47210
Name of the Vulnerable Software and Affected Versions Onlyoffice versions 22.11 through 25.05 Onlyoffice versions prior to Unstable 25.11 Description Onlyoffice is a software suite providing tools for document editing, collaboration, and management. A hard-coded secret within the NixOS module for...
MGASA-2025-0295 Updated botan2 packages fix security vulnerability
Botan before 3.6.0, when certain GCC versions are used, has a compiler-induced secret-dependent operation in lib/utils/donna128.h in donna128 used in Chacha-Poly1305 and x25519. An addition can be skipped if a carry is not set. This was observed for GCC 11.3.0 with -O2 on MIPS, and GCC on x86-i38...
Updated botan2 packages fix security vulnerability
Botan before 3.6.0, when certain GCC versions are used, has a compiler-induced secret-dependent operation in lib/utils/donna128.h in donna128 used in Chacha-Poly1305 and x25519. An addition can be skipped if a carry is not set. This was observed for GCC 11.3.0 with -O2 on MIPS, and GCC on x86-i38...
Malicious code in chain-test-async (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3e0c036eeb1631fbe88e6fc1c18dc89f31a900e1d528bd2027a2aef1eb35a60 The package chain-test-async was found to contain malicious code. Source: ghsa-malware c1d03d8b6de88ac68ebdd7ea00a039ed4f3d071cda41ca8e038c5cad8eb212...
Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990918)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990918 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/via: Avoid potential array out-of-bound in addsecretdacpath sndhdagetconnections can...
PT-2025-46914
Name of the Vulnerable Software and Affected Versions Directus versions prior to 11.13.0 Description Directus allows authenticated users to search concealed or sensitive fields when they have read permissions. While the actual values are masked, successful matches can be detected through returned...
Malicious code in mahnud-unag-goi (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2413f63a915b10225a2e308060b007b27d9371270938673936b045064621de15 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in spawn-sirius-venus-jovian (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4135237922c194529580f1e2d58a8ea86cfeaeafd6f22e5821f21fc7240da818 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-136881 Malicious code in secret_bird_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c14fcc7b14bd5901bc970a77de8b9502ed2bcfebf97ca47cce0ca95952190b6b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-136882 Malicious code in secret_condor_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a413ce836db767a6fa4d7dd39e1599b88a33c4b84c073ac347886b56b516251 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
podman: Podman kube play command may overwrite host files
There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the targ...
EUVD-2025-88883
Malicious code in secretgeckoz3n npm...
Malicious code in secret_roundworm_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b37c295e0aa4df7bdbffed8e42d04a9a8043fdc00a88142f96ea133a828f55e7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
podman: Podman kube play command may overwrite host files
There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the targ...
EUVD-2025-75692
Malicious code in secretsturgeon-tool npm...
EUVD-2025-73809
Malicious code in secretalpacaz3n npm...
MAL-2025-96483 Malicious code in secret_bonobo_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e80295bcd27cf89ba769867caa03b4824ae2a788cf81bdf27bd369f31c3bcf5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...