podman: Podman kube play command may overwrite host files

There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the targ...

podman: Podman kube play command may overwrite host files

There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the targ...

Malicious code in fezbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ced7d3b77fec12a874f274f33a417e27bbf21e58f9dfe01e15c734c92286dbc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-59432

SCRAM Salted Challenge Response Authentication Mechanism is part of the family of Simple Authentication and Security Layer SASL, RFC 4422 authentication mechanisms. Prior to version 3.2, a timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals...

CVE-2025-59434 Critical Multi-Tenant Variable Disclosure in Flowise Cloud via Custom JavaScript Function

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to August 2025 Cloud-Hosted Flowise, an authenticated vulnerability in Flowise Cloud allows any user on the free tier to access sensitive environment variables from other tenants via the Custom JavaScri...

CVE-2025-59432

SCRAM timing attack (CVE-2025-59432) affects the SCRAM Java implementation prior to v3.2 due to using Arrays.equals to compare secret values, causing variable execution time. It can enable a timing side‑channel to infer authentication material. The issue is mitigated by using constant-time compar...

CVE-2025-59432

SCRAM Salted Challenge Response Authentication Mechanism is part of the family of Simple Authentication and Security Layer SASL, RFC 4422 authentication mechanisms. Prior to version 3.2, a timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals...

MAL-2025-47507 Malicious code in vite-jsconfig (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f03bb7808458e6fe8226e85f4870698a47c60f6b846bd9f95283b27800b215ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47501 Malicious code in tailwind-cup-icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5b63b6f29071fd3e01046c19dd01c0f863e62d3c2fd92a1f51d040e5f06ec839 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47497 Malicious code in some-promise (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3558d5270ba6945f13c577df7f903f2e449b54435c6aa2ee46d721ef5e9ea198 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47496 Malicious code in recharts-smart (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c4ceccc5b595b8382c50ef249896ff0ebe9b299b3791bc7a7c5f90ec2f5481d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47491 Malicious code in postcss-calc-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a126d37fa7524804ef4c161588d71e9837418138fd67c7fbd8bc775d0f78a49f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47475 Malicious code in cui-travel-component (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 28f2686ec4318061b35e9018872a2a9f3a364c77dcf26ccc1bc405d36475d8fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-device-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 113702b97f378bfde6af287d00821b1e3ebec6cfa164e3d263f57632210869c8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-38740

Name of the Vulnerable Software and Affected Versions Creacast Creabox Manager version 4.4.4 Description The software exposes sensitive configuration data through a publicly accessible endpoint. Accessing the /get endpoint returns internal configuration details, including the creacodec.lua file,...

CVE-2025-59427

The Cloudflare Vite plugin enables a full-featured integration between Vite and the Workers runtime. When utilising the Cloudflare Vite plugin in its default configuration, all files are exposed by the local dev server, including files in the root directory that contain secret information such as...

CVE-2025-54807

The secret used for validating authentication tokens is hardcoded in device firmware for affected versions. An attacker who obtains the signing key can bypass authentication, gaining complete access to the system...

CVE-2025-10671

A vulnerability has been found in youth-is-as-pale-as-poetry e-learning 1.0. Impacted is the function encryptSecret of the file e-learning-master\exam-api\src\main\java\com\yf\exam\ability\shiro\jwt\JwtUtils.java of the component JWT Token Handler. The manipulation leads to insufficiently random...

CVE-2025-59427 Cloudflare vite plugin exposes secrets over the built-in dev server

The Cloudflare Vite plugin enables a full-featured integration between Vite and the Workers runtime. When utilising the Cloudflare Vite plugin in its default configuration, all files are exposed by the local dev server, including files in the root directory that contain secret information such as...

CVE-2025-54807

The secret used for validating authentication tokens is hardcoded in device firmware for affected versions. An attacker who obtains the signing key can bypass authentication, gaining complete access to the system...