CVE-2025-14505 Elliptic Cryptanalysis vulnerability when `k` has leading zeros

The ECDSA implementation of the Elliptic package generates incorrect signatures if an interim value of 'k' as computed based on step 3.2 of RFC 6979 https://datatracker.ietf.org/doc/html/rfc6979 has leading zeros and is susceptible to cryptanalysis, which can lead to secret key exposure. This...

CVE-2025-14505 Elliptic Cryptanalysis vulnerability when `k` has leading zeros

The ECDSA implementation of the Elliptic package generates incorrect signatures if an interim value of 'k' as computed based on step 3.2 of RFC 6979 https://datatracker.ietf.org/doc/html/rfc6979 has leading zeros and is susceptible to cryptanalysis, which can lead to secret key exposure. This...

CVE-2025-14505

The ECDSA implementation of the Elliptic package generates incorrect signatures if an interim value of 'k' as computed based on step 3.2 of RFC 6979 https://datatracker.ietf.org/doc/html/rfc6979 has leading zeros and is susceptible to cryptanalysis, which can lead to secret key exposure. This...

CVE-2025-14505 Elliptic Cryptanalysis vulnerability when `k` has leading zeros

The ECDSA implementation of the Elliptic package generates incorrect signatures if an interim value of 'k' as computed based on step 3.2 of RFC 6979 https://datatracker.ietf.org/doc/html/rfc6979 has leading zeros and is susceptible to cryptanalysis, which can lead to secret key exposure. This...

CVE-2025-14505

The CVE-2025-14505 entry concerns Elliptic’s ECDSA implementation. A fault in the ECDSA signing path occurs when the interim value of k (per RFC 6979 step 3.2) has leading zeros, causing the byte-length of k to be computed incorrectly and truncated. This can allow cryptanalytic leakage of the sec...

CVE-2026-21894 n8n's Missing Stripe-Signature Verification Allows Unauthenticated Forged Webhooks

n8n is an open source workflow automation platform. In versions from 0.150.0 to before 2.2.2, an authentication bypass vulnerability in the Stripe Trigger node allows unauthenticated parties to trigger workflows by sending forged Stripe webhook events. The Stripe Trigger creates and stores a Stri...

Malicious code in timeout-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1df00c4c63fa8e52f67bf4d40b5dadae1ddcb640d127546671ce2bf53b5eafa7 The package timeout-ts was found to contain malicious code. Source: ghsa-malware 16cf2a5883796e1a03bb6cc6da0182692fa5962abe42950ba3d95709ca928a71 Any...

MAL-2026-149 Malicious code in bnia-work (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f78b12fa102dbd32d8d3a27c016f7b790124a3a73bdf1970768799e120183c30 The package bnia-work was found to contain malicious code. Source: ghsa-malware 2583fa3177342feb8975727c7ad5873d1a1e7bea2ce3ce445343aaa9a0b3459b Any...

MAL-2026-151 Malicious code in svelte-monorepo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 822b182580c298051b9c1f8bb1e807bdb6c780fce64845002feebe37eddd0fad The package svelte-monorepo was found to contain malicious code. Source: ghsa-malware 1f5c5e96c4223fbe3046df01f3cda3aa9b821888050b45d82e92688609a7284...

PT-2026-1743

Name of the Vulnerable Software and Affected Versions Elliptic versions prior to 6.6.2 Description The ECDSA implementation within the Elliptic package produces incorrect signatures when an interim value of k calculated according to step 3.2 of RFC 6979 contains leading zeros, making it susceptib...

Malicious code in npe-toolkit-server-deps (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3eb14324fd68e20b30e8d4ebaa6af41f05a0596dd3e274650d3d75503199426 The package npe-toolkit-server-deps was found to contain malicious code. Source: ghsa-malware...

Malicious code in awsm-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86a8778a330765a0a4f5b15960d7bba1cf4ea76946cd4395eb239af31c497330 The package awsm-core was found to contain malicious code. Source: ghsa-malware ba13f4a6fbc556808377c1e17e991b77feb5d2d08af58861be6460732cfc3d9e Any...

MAL-2026-131 Malicious code in awsm-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86a8778a330765a0a4f5b15960d7bba1cf4ea76946cd4395eb239af31c497330 The package awsm-core was found to contain malicious code. Source: ghsa-malware ba13f4a6fbc556808377c1e17e991b77feb5d2d08af58861be6460732cfc3d9e Any...

MAL-2026-140 Malicious code in rt-live-hero (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b963cc4f9c61717fb440dbd17f3897337fd7aa94a3d077bcd8307c2faf109c57 The package rt-live-hero was found to contain malicious code. Source: ghsa-malware f56b0f0c83fe7af0849099067abaa56333d2eadffeb3f8152244c74b40a706d6 A...

Malicious code in spark-ar-dynamic-mocks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e041fd0dd06edcd5beedc3297cfb4326de3cb34e6e854601de47b872b93f9b24 The package spark-ar-dynamic-mocks was found to contain malicious code. Source: ghsa-malware...

CVE-2025-64305 Columbia Weather Systems MicroServer Cleartext Storage in a File or on Disk

MicroServer copies parts of the system firmware to an unencrypted external SD card on boot, which contains user and vendor secrets. An attacker can utilize these plaintext secrets to modify the vendor firmware, or gain admin access to the web portal...

CVE-2022-27201

Jenkins Semantic Versioning Plugin 1.13 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about the file path that can be parsed, allowing attackers able to control agent processes to have Jenkins parse a crafted file that uses externa...

CVE-2019-7887

A reflected cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 when the feature that adds a secret key to the Admin URL is...

CVE-2025-12540 ShareThis Dashboard for Google Analytics <= 3.2.4 - Unauthenticated Google Analytics Data Exposure

The ShareThis Dashboard for Google Analytics plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.4. This is due to the Google Analytics clientID and clientsecret being stored in plaintext in the publicly visible plugin source. This can...

Malicious code in @nestor_hexom/qyxb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0998609712e2df6e736e3da823279634b2cb874f692bba6f3ca65e452a4eb2a The package @nestorhexom/qyxb was found to contain malicious code. Source: ghsa-malware...