Access Control Bypass

Overview aim is a super-easy way to record, search and compare AI experiments. Affected versions of this package are vulnerable to Access Control Bypass due to the use of an outdated safergetattr function from RestrictedPython which fails to block the str.formatmap method. An attacker can leak...

Malicious code in chatbot-dashboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5af371ce3024a5ed217ff2baf8b2a9443cf92ae8a1993552e3679be6f83698a5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Improper Output Neutralization for Logs

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Improper Output Neutralization for Logs due to the incomplete masking of API keys in the logging functionality. An attacker can expose sensitive information by accessing th...

CVE-2024-9606

CVE-2024-9606 — Improper API key masking in Litellm A vulnerability in berriai/litellm prior to 1.44.12 arises from the masking logic in litellm_logging.py, which only masks the first 5 characters of API keys. This allows leakage of most of the secret key in logs, as noted for version v1.44.9 and...

Malicious code in n11-chatbot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1a368f528c1eb4b3da0f52628aed3b3e5ca54083842086c30a70a91d1110a3cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Important: Red Hat Security Advisory: Errata Advisory for Red Hat OpenShift GitOps v1.14.3 security update

An update is now available for Red Hat OpenShift GitOps v1.14.3. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

MAL-2025-2583 Malicious code in typespec-java (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d046f40bd24a36eef71000be2b720561f150cb503fc5caa2e9aa012fa1b0b884 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Timing Side-channel Attacks

postquantumfeldmanvss is vulnerable to Timing side-channel attacks. The vulnerability is due to Python's non-constant-time execution model, which causes execution time variations in the findsecurepivot and securematrixsolve functions, allowing attackers to infer secret information through precise...

SUSE CVE-2025-29781

The Bare Metal Operator BMO implements a Kubernetes API for managing bare metal hosts in Metal3. Baremetal Operator enables users to load Secret from arbitrary namespaces upon deployment of the namespace scoped Custom Resource BMCEventSubscription. Prior to versions 0.8.1 and 0.9.1, an adversary...

Malicious code in azure-rest-api-specs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9b45f4b5db07c14af82f92638c97d70419c7936860274a00dbea1e18db0b58f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-12313

Name of the Vulnerable Software and Affected Versions berriai/litellm version 1.52.1 Description An issue in the proxy server.py file causes the leakage of Langfuse API keys when an error occurs while parsing team settings. This exposes sensitive information, including langfuse secret and langfus...

unsanitised Input in code node

Description We can run sandboxed code node with full permissions, before the the sandbox security restrictions are imposed. Javascript allows overriding global functions, thus by defining the parseInt function inside a javascript code node, we are able to execute code with full root permissions o...

Malicious code in pb-node-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 13f6ed4f1be7aaf5a813cae62ab02bae6da785284b44b4ec1ef18522f3c0f7a4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-11994

Name of the Vulnerable Software and Affected Versions LangChain Core affected versions not specified Description A serious flaw exists in LangChain Core that allows attackers to steal secrets through serialization injection. This impacts applications utilizing LangChain’s serialization features...

GO-2025-3530 Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD in github.com/metal3-io/baremetal-operator/apis

Bare Metal Operator BMO can expose any secret from other namespaces via BMCEventSubscription CRD in github.com/metal3-io/baremetal-operator/apis...

MAL-2025-2529 Malicious code in syncdaemon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f5bb66f3a9159e25129919edb2f4a2e771c86ee56706bcddaa2c0c2fcbf0df0c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2535 Malicious code in tokes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d5e2d95dad58403b31cf8453a2e412a16f561203b18d33a2f293979a75f9243 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in syncdaemon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f5bb66f3a9159e25129919edb2f4a2e771c86ee56706bcddaa2c0c2fcbf0df0c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2533 Malicious code in test111121112 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4e7f90b0dbff465793a22420e768063e39536ec5b397bd17e50a532bdeaf873c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2520 Malicious code in paymentapiplatformservice-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ac6842fa9d4708f9231bcffca06ec0806d5fe181a7e16ae1efe1cd6a37168c3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...