PT-2025-22564 · Red Hat +1 · Keycloak +1

Name of the Vulnerable Software and Affected Versions: zot versions prior to 2.1.3 Description: The issue concerns the exposure of the Keycloak client secret in the container stdout logs at startup when using Keycloak as an OIDC provider. This occurs due to a flaw in handling sensitive informatio...

CVE-2005-4002

WebEOC before 6.0.2 uses the same secret key for all installations, which allows attackers with the key to decrypt data from any WebEOC installation...

Malicious code in lol-ninegacha (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 332626b1c4ee5d04b9cf7d47646efa1f37df2e108866df823ccf410a9026d869 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lol-project-2017 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 713140b3d10253eb856068004fa4bc07dfbc38a48b4f0a2a706fe7c242284553 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in grammy-telegram-bot-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9f9cf91971b8da8348bf38f6f6b21351467c1d6e8eb00c76fdfbd4c52ab6f389 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4094 Malicious code in lock-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0be45276ce7d117215945fe26ddbc98fb0cc53d60ecdaa71631175e44f8d4bb3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4136 Malicious code in typescri (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38f04c3fc11a28f8c6d0deae7aa58501ba6e77e2641fac6e541e6ced55c8928c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4073 Malicious code in create-qr-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 58919bf64984f8dcdd4ec2802325f47fd7ef1a21aa8f1cb4d9c64549054122bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4069 Malicious code in com.meta.xr.sdk.avatars.sample.assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 09a9d5a626622260968ebe26077b57efd3ec56b069d8808fe569f79523a7095a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4110 Malicious code in node-wavehttp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3f86a00e28589e2a90709cc928ecf437d7df51dbe5685e8aa68dad43c7df6f77 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in selfbot-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 92ee16ff7e543c8573a19890767cf8320aa7357d16d99197788c25180b8a8be6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in web3walletconnect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e6379b5bb35b541783545d3399d145213c35e8db9351a2ba95b8ef457db094e4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rpc-selffbott (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24aeadfdb12f863044ca5714c437fb59d3d8099cda972978383afa16bf96ef2c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4130 Malicious code in selfbott-rpc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 860baf78f0f4f83405dc224345b0d30845128219a809a6e76e89c17493419fda Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4121 Malicious code in rpc-selffbott (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24aeadfdb12f863044ca5714c437fb59d3d8099cda972978383afa16bf96ef2c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pro-article-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 30d5ce94037caccdc08f9aa0d0b4e3c7ad2d0aa541b93fafeba6db855b86b2d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Fedora 41 : perl-Mojolicious (2025-c38fd06bec)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-c38fd06bec advisory. Mojolicious versions from 0.999922 through 9.39 for Perl uses a hard coded string, or the application's class name, as a HMAC session secret by...

Malicious code in discord-clients (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 06928cb5dce29b93a1ece92d5bb04ef3a8731f510409097aef187e63be4890ac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4054 Malicious code in web3-provider-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc3ff80c31877ea658c6e65be0a05a240bf2a26f8c84e19e2dc75e88abbcd6c4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4055 Malicious code in web3connectjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f387b5fbd03228464d4424e763f855d7e1327cd5b6d79fe4fddec7e9baa9107 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...