Malicious code in react-stylizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 812122411d8ab81ce837c1af7272056e2f1dd88b413f290021a615d5ad03524e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6345 Malicious code in vite-plugin-js-support (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 623ab60cdb0568726940f6f7f51b62cad9f69bd835cbf4e9a0fcbda0530a307c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-32446

Name of the Vulnerable Software and Affected Versions: TRENDnet TN-200 version 1.02b02 Description: A vulnerability exists in the TRENDnet TN-200 device. The issue resides in the Lighttpd component, where manipulation of the secdownload.secret argument with the input neV3rUseMe results in the use...

CVE-2025-54428

RevelaCode is an AI-powered faith-tech project that decodes biblical verses, prophecies and global events into accessible language. In versions below 1.0.1, a valid MongoDB Atlas URI with embedded username and password was accidentally committed to the public repository. This could allow...

CVE-2025-54428 RevelaCode exposes Sensitive MongoDB Atlas URI in .env (potential credential leak)

RevelaCode is an AI-powered faith-tech project that decodes biblical verses, prophecies and global events into accessible language. In versions below 1.0.1, a valid MongoDB Atlas URI with embedded username and password was accidentally committed to the public repository. This could allow...

CVE-2025-54428 RevelaCode exposes Sensitive MongoDB Atlas URI in .env (potential credential leak)

RevelaCode is an AI-powered faith-tech project that decodes biblical verses, prophecies and global events into accessible language. In versions below 1.0.1, a valid MongoDB Atlas URI with embedded username and password was accidentally committed to the public repository. This could allow...

CVE-2025-54428

CVE-2025-54428 affects RevelaCode prior to 1.0.1. A valid MongoDB Atlas URI with embedded credentials was committed to the public repository, enabling potential unauthorized access to production or staging databases and possible data exfiltration, modification, or deletion. The issue is resolved ...

ChanCMS 访问控制错误漏洞

ChanCMS is a content management system by yanyutao0402 individual developer in China. An access control error vulnerability exists in ChanCMS 3.1.2 and earlier versions, which originates from information leakage due to incorrect operation of the parameters accessKey/secretKey in the file...

Sparse Regression Codes for Secret Key Agreement: Achieving Strong Secrecy and Near-Optimal Rates for Gaussian Sources

Secret key agreement from correlated physical layer observations is a cornerstone of information-theoretic security. This paper proposes and rigorously analyzes a complete, constructive protocol for secret key agreement from Gaussian sources using Sparse Regression Codes SPARCs. Our protocol...

CVE-2025-54415 dag-factory's CI/CD Workflow Allows for Repository Takeover and Secret Exfiltration

dag-factory is a library for Apache Airflow® to construct DAGs declaratively via configuration files. In versions 0.23.0a8 and below, a high-severity vulnerability has been identified in the cicd.yml workflow within the astronomer/dag-factory GitHub repository. The workflow, specifically when...

CVE-2025-54415

CVE-2025-54415 affects the dag-factory project (Apache Airflow) for versions ≤ 0.23.0a8. The vulnerability lies in the cicd.yml workflow configured in the astronomer/dag-factory GitHub repository, which, when triggered by pull_request_target, can be exploited to execute arbitrary code in the GitH...

CVE-2025-54415 dag-factory's CI/CD Workflow Allows for Repository Takeover and Secret Exfiltration

dag-factory is a library for Apache Airflow® to construct DAGs declaratively via configuration files. In versions 0.23.0a8 and below, a high-severity vulnerability has been identified in the cicd.yml workflow within the astronomer/dag-factory GitHub repository. The workflow, specifically when...

CVE-2025-38396 fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass

In the Linux kernel, the following vulnerability has been resolved: fs: export anoninodemakesecureinode and fix secretmem LSM bypass Export anoninodemakesecureinode to allow KVM guestmemfd to create anonymous inodes with proper security context. This replaces the current pattern of calling...

CVE-2025-38396 fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass

In the Linux kernel, the following vulnerability has been resolved: fs: export anoninodemakesecureinode and fix secretmem LSM bypass Export anoninodemakesecureinode to allow KVM guestmemfd to create anonymous inodes with proper security context. This replaces the current pattern of calling...

MAL-2025-6236 Malicious code in grafana-config-pipeline (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24878cfe315198916799cf0320237c09a463a1ff8b50f0d5ff6bdc70ba117ca5 Any computer that has this package installed or running should be considered...

MAL-2025-6247 Malicious code in vitejs-plugin-react-refresh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1686bc018b42cf0146c11ecc1796ef7bad5ed0bb6b07eae4ceffd65b35f36255 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6298 Malicious code in openai-fm (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8926ff7d91a01298fc220ba494c8948e0480927fffc10ee396d0dd3bfe6ba2e0 Any computer that has this package installed or running should be considered...

Malicious code in openai-fm (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8926ff7d91a01298fc220ba494c8948e0480927fffc10ee396d0dd3bfe6ba2e0 Any computer that has this package installed or running should be considered...

MAL-2025-6215 Malicious code in bingo-abstract-transport (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c453cfd4d38bc70b9b47a64bb81b2c3c982b8811f3fefe95b1788b5a24340808 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6217 Malicious code in bingo-pretty (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware db9cd7f456a7e51d21294046604654fa4f3ec5b9ee11c7acd713ab08ad6838da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...