Malicious code in requests-json-overview-pkg (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0086e01d67b35f7c81bc1dd5ed909ade2520cf967356bfd3b4849d1372952a6a Any computer that has this package installed or running should be considered...

Security update for libcryptopp

This update for libcryptopp fixes the following issues: CVE-2024-28285: Fixed potential leak of secret key of ElGamal encryption via fault injection bscbsc1224280. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch...

SUSE-SU-2025:01939-1 Security update for libcryptopp

This update for libcryptopp fixes the following issues: - CVE-2024-28285: Fixed potential leak of secret key of ElGamal encryption via fault injection bscbsc1224280...

GHSA-M3MQ-F375-5VGH Vantage6 Server JWT secret not cryptographically secure

Impact The JWT secret key in the vantage6 server is auto-generated unless defined by the user. The auto-generated key is a UUID1, which is not cryptographically secure as it is predictable to some extent Patches No Workarounds You may define JWT secret key in the server configuration file...

Vantage6 Server JWT secret not cryptographically secure

Impact The JWT secret key in the vantage6 server is auto-generated unless defined by the user. The auto-generated key is a UUID1, which is not cryptographically secure as it is predictable to some extent Patches No Workarounds You may define JWT secret key in the server configuration file...

PYSEC-2025-221

vantage6 is an open-source infrastructure for privacy preserving analysis. The JWT secret key in the vantage6 server is auto-generated unless defined by the user. The auto-generated key is a UUID1, which is not cryptographically secure as it is predictable to some extent. This vulnerability is...

PYSEC-2025-221

vantage6 is an open-source infrastructure for privacy preserving analysis. The JWT secret key in the vantage6 server is auto-generated unless defined by the user. The auto-generated key is a UUID1, which is not cryptographically secure as it is predictable to some extent. This vulnerability is...

CVE-2025-43866

vantage6 is an open-source infrastructure for privacy preserving analysis. The JWT secret key in the vantage6 server is auto-generated unless defined by the user. The auto-generated key is a UUID1, which is not cryptographically secure as it is predictable to some extent. This vulnerability is...

CVE-2025-43866 Vantage6 Server JWT secret not cryptographically secure

vantage6 is an open-source infrastructure for privacy preserving analysis. The JWT secret key in the vantage6 server is auto-generated unless defined by the user. The auto-generated key is a UUID1, which is not cryptographically secure as it is predictable to some extent. This vulnerability is...

CVE-2025-43866 Vantage6 Server JWT secret not cryptographically secure

vantage6 is an open-source infrastructure for privacy preserving analysis. The JWT secret key in the vantage6 server is auto-generated unless defined by the user. The auto-generated key is a UUID1, which is not cryptographically secure as it is predictable to some extent. This vulnerability is...

CVE-2025-43866 Vantage6 Server JWT secret not cryptographically secure

vantage6 is an open-source infrastructure for privacy preserving analysis. The JWT secret key in the vantage6 server is auto-generated unless defined by the user. The auto-generated key is a UUID1, which is not cryptographically secure as it is predictable to some extent. This vulnerability is...

CVE-2025-43866

Vantage6 Server JWT secret not cryptographically secure: the auto-generated key uses UUID1, which is partially predictable. This exposes potential forgery of security tokens. The issue is fixed in version 4.11.0; upgrading to 4.11.0+ or defining a custom JWT secret in configuration mitigates the ...

MAL-2025-4945 Malicious code in zora-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5434c40d3048f846ef1d268e25b386ee6000460a939ff2aa2d91dd67ea1e897d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4944 Malicious code in zora-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1e30772071c478b59fc6e1b5d6140a12299f0c0c63ddf092764161443070c0b7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in zora-wallet-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2737a01b1cbbdc588edaadc6a0e02fe571afdcfe804c62a691270ab2e19eefd8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in test-victim (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cfdba951804f9f995d7d98ea8a645ead6bc94767502ab6a7943133b5e34125f1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dojo.aspect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d31fd63b97c3cdde47f88984fbd8825829cf78c16098685c438206151cbc31f2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in web3-socketio (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2131391b300bee27a2d4e470c16bf37492276c2e92a4895a34f5933d5d0602b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Non-Human Identities: How to Address the Expanding Security Risk

Human identities management and control is pretty well done with its set of dedicated tools, frameworks, and best practices. This is a very different world when it comes to Non-human identities also referred to as machine identities. GitGuardian's end-to-end NHI security platform is here to close...

PT-2025-25343 · Vantage6 · Vantage6

Name of the Vulnerable Software and Affected Versions: vantage6 versions prior to 4.11.0 Description: The vantage6 server has a predictable JWT secret key generation issue. The auto-generated key is a UUID1, which is not cryptographically secure as it is predictable to some extent. This issue...