MAL-2025-2324 Malicious code in rc-tab-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 18b8964f26c1878550507ca94c6b9a9e5c39dea20e6fa0cec40bbd8bba88b6af Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in shein-uesragent-detection (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bdca3a489ad131847e2e1677f86805c89bd1587e8a76fb2fea69415952284909 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rc-upload-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e8c8a04b14788b037fccbfd5f9be8c5f83d54da6321b13d213287d683a937baf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2329 Malicious code in shein-uesragent-detection (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bdca3a489ad131847e2e1677f86805c89bd1587e8a76fb2fea69415952284909 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ward-steward (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 97a827b103b01a6bf01068abd3e9602f463700eb8f9e66c2cc6b051374d1f40f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2318 Malicious code in language-ring (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ca7e9ac770686a75d1d581c790e326d66e60e71b9caa83f387a527c3d5e2df88 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in auth0-langgraph-state-rag-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4726a148bd39bb68771231f6ed71f2edab6932f2f9468e69b5f659528ebb6d4f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2246 Malicious code in code-comment-linter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 26ce443e50fdb64ff72252215dd99c231fec238376c9f7b692c0214c2e27e582 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in image-watermarks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 696779031d179d99d69d2fd89de3ae89e25e8bc093c528000aeb73c0bf7525f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bastion-react-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7b653fe85132d2b38f6455a8b98a9d59deccd8982eaf7c9e13d97d1037dbc6a4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rexz-imagine-ai (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2a5880974c43ddaa1e24f3eecce7e9eb1e66d31adb347a095436a27316c30097 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2238 Malicious code in angularonlineauthclient (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e5e5f25e1cac80da371793d8ae6bcabf3edb1c742f67871b9777db35c9b7a078 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in radar-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e3c3b76c65176007f3c376c09b22d085bc9fba8527c7b806acca53816e6cebf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2274 Malicious code in react-textfit-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cd133ed4ff9a23964d050578a197c7d8d9a45ba07d60f2d3b031b350bae49370 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in example-nodejs-express (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb2351b3777bfaea370237b22b5155a53e293162cb01bca791717b05107a4b7c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2266 Malicious code in mijn-bureau-portal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 16c92a4b0e65219383cc8ed9abf729b1ae9a84f24fcdb6f9f5385235ca48c9e7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Information Disclosure

Jenkins is vulnerable to information disclosure. The vulnerability is due to improper redaction of encrypted secret values in config.xml when accessed via REST API or CLI, allowing attackers with View/Read permission to retrieve sensitive information...

Cleartext Storage Of Sensitive Information

Jenkins is vulnerable to Cleartext Storage of Sensitive Information. The vulnerability is due to improper secret redaction due to config.xml of agents being accessible via the REST API or CLI, allowing attackers with Agent/Extended Read permission to view encrypted secret values...

GHSA-9M63-33Q3-XQ5X Vela Server Has Insufficient Webhook Payload Data Verification

Impact Users with an enabled repository with access to repo level CI secrets in Vela are vulnerable to the exploit. Any user with access to the CI instance and the linked source control manager can perform the exploit. Method By spoofing a webhook payload with a specific set of headers and body...

Nomad is vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs

Nomad Community and Nomad Enterprise “Nomad” are vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs. This vulnerability, identified as CVE-2025-1296, is fixed in Nomad Community Edition 1.9.7 and Nomad Enterprise 1.9.7, 1.8.11, and 1.7.19...