Linux Kernel IPv6 Segment Routing Vulnerable to Out-of-Bounds Read via Crafted Netlink Message in SRv6 Layer

IPv6 Segment Routing SRv6 is vulnerable to an out-of-bounds read when setting HMAC data due to a lack of validation in the SEG6ATTRSECRETLEN attribute. This could allow an attacker to read up to 64 bytes of data past the skb end pointer and into skbsharedinfo, potentially leading to information...

CVE-2025-20325

In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.103, 9.3.2408.113, and 9.2.2406.119, the software potentially exposes the search head cluster splunk.secret key. This exposure could happen if you have a Search Head cluster and...

Malicious code in ru.rustore.core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 00da899e7e957138cf68d9b59fa02210d5b3cae226639924b65810cfa7c4ce78 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-3466 Unsanitized Input in langgenius/dify

langgenius/dify versions 1.1.0 to 1.1.2 are vulnerable to unsanitized input in the code node, allowing execution of arbitrary code with full root permissions. The vulnerability arises from the ability to override global functions in JavaScript, such as parseInt, before sandbox security restrictio...

Splunk Enterprise 9.1.0 < 9.1.10, 9.2.0 < 9.2.7, 9.3.0 < 9.3.5, 9.4.0 < 9.4.3 (SVD-2025-0709)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2025-0709 advisory. - In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.103,...

The vulnerability of the Introspection Mode feature of the openid-connect plugin for the Apache APISIX cloud API gateway allows a attacker to gain access to the user’s account.

The vulnerability of the Introspection Mode feature in the openid-connect plugin for the Apache APISIX cloud API gateway involves bypassing authentication by using the same secret key. Exploiting this vulnerability could allow a malicious actor to gain access to a user’s account remotely...

MAL-2025-5824 Malicious code in securityresearchpocaplmalpkg (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b52864b8ab4058696fe0a34e9cdea2db8e1f9dec2fdb22fac1adeb4143cc63a0 Any computer that has this package installed or running should be considered...

MAL-2025-5647 Malicious code in vsts-iiswebapp (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 218ebf35158467cc942d14847b051f60d810e2ba76f2e48249bc955b0fce2e05 Any computer that has this package installed or running should be considered...

CVE-2025-7079 mao888 bluebell-plus JWT Token jwt.go hard-coded password

A vulnerability, which was classified as problematic, has been found in mao888 bluebell-plus up to 2.3.0. This issue affects some unknown processing of the file bluebellbackend/pkg/jwt/jwt.go of the component JWT Token Handler. The manipulation of the argument mySecret with the input bluebell-plu...

CVE-2025-5920

The Sharable Password Protected Posts before version 1.1.1 allows access to password protected posts by providing a secret key in a GET parameter. However, the key is exposed by the REST API...

MAL-2025-5766 Malicious code in bazel-kotlin (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 68e72bd563ced782c2a9514e4b3c995c7232eb432728faca3a7dcc9ec8f64ad2 Any computer that has this package installed or running should be considered...

MAL-2025-5632 Malicious code in auth0-styleguide-website (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4ac62aa1f1cbfe11927a1bc4a54326be2b214f65a0d101d475bf45c44b0d96f4 Any computer that has this package installed or running should be considered...

MAL-2025-5631 Malicious code in canonical-bridge-ui (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e38c4c4332b7b6efd48d2c9360444d99754e398a49f7099e1d7a5cef7fb22358 Any computer that has this package installed or running should be considered...

MAL-2025-5678 Malicious code in confluence-drag-and-drop (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 54563a65c5fe90e7a08c946b6834cd15582defd6ad21f41d09867195dc699b36 Any computer that has this package installed or running should be considered...

CVE-2025-6942

The distributed engine versions 8.4.39.0 and earlier of Secret Server versions 11.7.49 and earlier can be exploited during an initial authorization event that would allow an attacker to impersonate another distributed engine...

CVE-2025-6943

Secret Server version 11.7 and earlier is vulnerable to a SQL report creation vulnerability that allows an administrator to gain access to restricted tables...

CVE-2025-5920

The Sharable Password Protected Posts before version 1.1.1 allows access to password protected posts by providing a secret key in a GET parameter. However, the key is exposed by the REST API...

MAL-2025-5535 Malicious code in pyroscope-nodejs (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0f63660c0844969995da8de5a83535772031d00f3247e8cbb5a40addbc21a234 Any computer that has this package installed or running should be considered...

CVE-2025-6943

Secret Server version 11.7 and earlier is vulnerable to a SQL report creation vulnerability that allows an administrator to gain access to restricted tables...

CVE-2025-6943

Secret Server version 11.7 and earlier is vulnerable to a SQL report creation vulnerability that allows an administrator to gain access to restricted tables...