MAL-2025-1706 Malicious code in airbnb-checkout (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-1682 Malicious code in 3952955c8e968410 (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-1698 Malicious code in @smt-front/inner-landing (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-1695 Malicious code in @mp-food/restaurant-orders (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-1691 Malicious code in @kone-ds/tokens (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-1684 Malicious code in @aoflmkt/form-validators (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2025-0475 vulnerabilities

Vulnerabilities for packages: gitlab-runner, gitlab-runner-fips...

CVE-2025-0475 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1. A proxy feature could potentially allow unintended content rendering leading to XSS under specific circumstances...

CVE-2024-8186 vulnerabilities

Vulnerabilities for packages: gitlab-runner, gitlab-runner-fips...

OPENSUSE-SU-2025:0080-1 Security update for trivy

This update for trivy fixes the following issues: Update to version 0.59.1: - CVE-2025-27144: Fixed Go JOSE's Parsing Vulnerable to Denial of Service boo1237618...

MAL-2025-2024 Malicious code in @f2p-mml-frontends/mml-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 983731c41dcce79ac1385591adacf0e23cc21f82e4d2bfadff7fb3bb79cf2e2b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Flask-AppBuilder Observable Response Discrepancy

User enumeration in database authentication in Flask-AppBuilder = 3.0.0. Allows for a non authenticated user to enumerate existing usernames by timing the response time from the server when brute forcing requests to login...

CVE-2025-23405

Unauthenticated log effects metrics gathering incident response efforts and potentially exposes risk of injection attacks ex log injection...

MAL-2025-1666 Malicious code in metrics-aggregator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6cd896083dc19fbe781ed9f414bc1a72581378e63717086f459e1b03fd0c058c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-1749

HTML injection vulnerabilities in OpenCart versions prior to 4.1.0. These vulnerabilities could allow an attacker to modify the HTML of the victim's browser by sending a malicious URL and modifying the parameter name in /account/voucher...

CVE-2025-1747

HTML injection vulnerabilities in OpenCart versions prior to 4.1.0. These vulnerabilities could allow an attacker to modify the HTML of the victim's browser by sending a malicious URL and modifying the parameter name in /account/login...

MAL-2025-1661 Malicious code in ringcentral-web-phone-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f5d0cdb47587dfa64b594d26d1b33dea3d9cb70b7f8a581fa66d1f005df4ee60 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Advisory ROSA-SA-2025-2753

Software: openssl 1.1.1k OS: ROSA Virtualization 2.1 packageevrstring: openssl-1.1.1.1k-12.0.1.rv3 CVE-ID: CVE-2020-25659 BDU-ID: 2022-05647 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the python-cryptography package of the Python programming language interpreter is related to RSA key management...

MAL-2025-1657 Malicious code in okta-sdk-php-openapi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da144ffdf9eed05ec70b485602e1d3aeae40d312d6fd4eec8956422e2365bd0b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1656 Malicious code in azps (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6c955269826233e665b0f2e27c31b025ab3e5ab1ff1a46049d06df4c02d5a48 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...