Standing Firm in 5G: a Single-Round, Dropout-Resilient Secure Aggregation for Federated Learning

Federated learning FL is well-suited to 5G networks, where many mobile devices generate sensitive edge data. Secure aggregation protocols enhance privacy in FL by ensuring that individual user updates reveal no information about the underlying client data. However, the dynamic and large-scale...

Malicious code in com.unity.platforms (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 161c7b1f35e6c192a0f74cd71cf87b2b6436cc4528a32757f6901c2ce6ff7c07 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in com.unity.list-view-framework (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4e62e603878259ca3d97124f0e3dd5225e75518c1572831a35e96a26b807e151 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-3506

Files to be deployed with agents are accessible without authentication in Checkmk 2.1.0, Checkmk 2.2.0, Checkmk 2.3.0 and...

CVE-2025-33093

IBM Sterling Partner Engagement Manager 6.1.0, 6.2.0, 6.2.2 JWT secret is stored in public Helm Charts and is not stored as a Kubernetes secret...

UBUNTU-CVE-2025-3506

Files to be deployed with agents are accessible without authentication in Checkmk 2.1.0, Checkmk 2.2.0, Checkmk 2.3.0 and Checkmk 2.4.0b6 allows attacker to access files that could contain secrets...

SUSE CVE-2024-58134

Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default. These predictable default secrets can be exploited by an attacker to forge session cookies. An attacker who knows or guesses the secret could compute...

SUSE CVE-2025-4166

Vault Community and Vault Enterprise Key/Value kv Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability, identified as CVE-2025-4166, is...

MAL-2025-3869 Malicious code in albatross-test2-module (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a452ae314d4752629c6c4f9009c4e7e65249f015e18a4caf86ed8de23e26bc43 Any computer that has this package installed or running should be considered...

CVE-2025-33093

IBM Sterling Partner Engagement Manager 6.1.0, 6.2.0, 6.2.2 JWT secret is stored in public Helm Charts and is not stored as a Kubernetes secret...

CVE-2025-33093 IBM Sterling Partner Engagement Manager information disclosure

IBM Sterling Partner Engagement Manager 6.1.0, 6.2.0, 6.2.2 JWT secret is stored in public Helm Charts and is not stored as a Kubernetes secret...

CVE-2025-33093 IBM Sterling Partner Engagement Manager information disclosure

IBM Sterling Partner Engagement Manager 6.1.0, 6.2.0, 6.2.2 JWT secret is stored in public Helm Charts and is not stored as a Kubernetes secret...

CVE-2025-33093

The CVE-2025-33093 issue affects IBM Sterling Partner Engagement Manager (PEM) versions 6.1.x, 6.2.0, and 6.2.2, where the JWT secret was stored in public Helm charts instead of a Kubernetes secret. Root cause: improper key storage (CWE-260) leading to potential information disclosure. Impact sta...

Malicious code in gx-npm-messenger-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 26007d847aa029d08defbaa44538b81f13b13adfd8edb4c7ea3fc335a439e0f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ias-dashboard-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7c5e715ecf1204e540d58dcb1f94d07ca5724d7a1a0df89b355dbe88545c5185 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: IBM Sterling Partner Engagement Manager has several issues with secrets management (CVE-2025-33093)

Summary IBM Sterling Partner Engagement Manager's JWT secret is stored in public Helm Charts and is not stored as a Kubernetes secret. This issue has been addressed in the latest Helm Chart. Vulnerability Details CVEID:CVE-2025-33093 DESCRIPTION: IBM Sterling Partner Engagement Manager's JWT secr...

MAL-2025-3689 Malicious code in internal-lib-t1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0656cbf9afeeae51e03fe153910e1dad3a3840f219effb0583665acdfefb34ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3677 Malicious code in @starkgate/web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d04ac8d00e82f7a03fdd3b70ec5682e6ebde4a7fb03c4f1459f2b1125db11296 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3692 Malicious code in orvyn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cd01e3d586f0edf229980ae5ae7260dfec26f727da9ac8379a5ff20a4972b45a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-20069

Name of the Vulnerable Software and Affected Versions IBM Sterling Partner Engagement Manager versions 6.1.0 through 6.2.2 Description The issue concerns the storage of the JWT secret in public Helm Charts, rather than as a Kubernetes secret. This affects IBM Sterling Partner Engagement Manager...