MAL-2025-3500 Malicious code in needlecast_b9s_jewel_fyc_fe_client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0103a210a9570aca60dd6b0b9583710312fb9116674baaf17a9f6ae3084e462 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3491 Malicious code in gcp-alert-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 08d19b607b4f352b166f0a4c5a1e6189aca16d98607043baba144dba19d9ff70 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3503 Malicious code in testdoges (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 042d70fcdce39518a09164e3d86d8403a4de0ad9697aee15c56f3fc289985a8b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security of a Secret Sharing Protocol on the Qline

Secret sharing is a fundamental primitive in cryptography, and it can be achieved even with perfect security. However, the distribution of shares requires computational assumptions, which can compromise the overall security of the protocol. While traditional Quantum Key Distribution QKD can...

GTSD: Generative Text Steganography Based on Diffusion Model

With the rapid development of deep learning, existing generative text steganography methods based on autoregressive models have achieved success. However, these autoregressive steganography approaches have certain limitations. Firstly, existing methods require encoding candidate words according t...

CVE-2025-43916

Sonos api.sonos.com through 2025-04-21, when the /login/v3/oauth endpoint is used, accepts a redirecturi containing userinfo in the authority component, which is not consistent with RFC 6819 section 5.2.3.5. An authorization code may be sent to an attacker-controlled destination. This might have...

CVE-2025-27936

Mattermost Plugin MSTeams versions 2.1.0 and Mattermost Server versions 10.5.x =10.5.1 with the MS Teams plugin enabled fail to perform constant time comparison on a MSTeams plugin webhook secret which allows an attacker to retrieve the webhook secret of the MSTeams plugin via a timing attack...

GHSA-XGPC-Q899-67P8 Fleet doesn’t validate a server’s certificate when connecting through SSH

Impact A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting through SSH if the certificate isn’t set in the knownhosts file. This could allow the execution of a man-in-the-middle MitM attack against Fleet...

Improper Ownership Management

Overview github.com/rancher/rancher/pkg/controllers/managementuser/secret is a project that provides a container management platform built for organizations that deploy containers in production Affected versions of this package are vulnerable to Improper Ownership Management for projects, whose...

MAL-2025-3393 Malicious code in dowload_ebok_tragic_design_by_jonathan_shariat_cynthia_savard_saucier_0jkyy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4df41f6df1da311b66bb02e6bd7ede493b44f3746f30acbad2c3dfd7403166ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Why NHIs Are Security's Most Dangerous Blind Spot

When we talk about identity in cybersecurity, most people think of usernames, passwords, and the occasional MFA prompt. But lurking beneath the surface is a growing threat that does not involve human credentials at all, as we witness the exponential growth of Non-Human Identities NHIs. At the top...

Timing Attack

github.com/mattermost/mattermost-server is vulnerable to a Timing attack. The vulnerability is due to improper implementation of constant time comparison when comparing the MSTeams plugin webhook secret, allows an attacker to exploit timing differences in the comparison process to extract the...

PT-2025-18266 · Ctrlx Os · Ctrlx Os

Name of the Vulnerable Software and Affected Versions: ctrlX OS affected versions not specified Description: A vulnerability in the “Backup & Restore” functionality of the web application allows a remote authenticated low-privileged attacker to access secret information via multiple crafted HTTP...

Malicious code in discord-vc-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 57a74516506d551102adff697246e1f0a75c62372b7d5eeedd8b4f2dca093bcf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in echo-color (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3f49c42944e8358945b0e71cfb98fe50999b199d5f3e12802e35b84c9893c5c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE CVE-2025-27936

Mattermost Plugin MSTeams versions 2.1.0 and Mattermost Server versions 10.5.x =10.5.1 with the MS Teams plugin enabled fail to perform constant time comparison on a MSTeams plugin webhook secret which allows an attacker to retrieve the webhook secret of the MSTeams plugin via a timing attack...

SUSE CVE-2025-30206

Dpanel is a Docker visualization panel system which provides complete Docker management functions. The Dpanel service contains a hardcoded JWT secret in its default configuration, allowing attackers to generate valid JWT tokens and compromise the host machine. This security flaw allows attackers ...

Authentication Bypass

Dpanel is vulnerable to Authentication Bypass. The vulnerability is due to use of a hardcoded JWT secret due to the default configuration embedding a static secret, allowing attackers to forge valid tokens and gain unauthorized administrative access...

uri: userinfo leakage in URI#join, URI#merge and URI#+

A flaw was found in the URI ruby gem package, where userinfo leakage can occur in the uri gem. The methods URIjoin, URImerge, and URI+ retained userinfo, such as user:password, even after the host is replaced. When generating a URL to a malicious host from a URL containing secret userinfo using...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.16.39 bug fix and security update

Red Hat OpenShift Container Platform release 4.16.39 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.16. Red Hat Product Security has rated this update as having a...