MAL-2025-190686 Malicious code in @trigo/jsdt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff5aae2e5762514a4d2a304a2ceb36d9b895c8bd88c9a6303752aea4b078119f The package @trigo/jsdt was found to contain malicious code. Source: ghsa-malware 91f1b0ba55c42b887eade435580838bef529a7fe7a9b9fd8b3cd05ada0528cc7 An...

MAL-2025-190673 Malicious code in @posthog/rrweb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e7ff62f7afccd552b5eff3833fa122ace1a2f8ef6447e4b372673896063098f The package @posthog/rrweb was found to contain malicious code. Source: ghsa-malware 8278c73c0fa29817d8923864303d2e24c5a7bd038a9f8a2cae587329a3837cab...

MAL-2025-190665 Malicious code in @ensdomains/address-encoder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec8264ecb2af0b5028f08af1a108f7fe73cd1cbe55ea2cb7102a3e28b2e1052e The package @ensdomains/address-encoder was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190691 Malicious code in @zapier/secret-scrubber (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c109e973086267fe5b99a110c559267a26254a0bb87dcffbaf3fb69ea4bbca75 The package @zapier/secret-scrubber was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190671 Malicious code in @posthog/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57662af8290901771cf534d8b1ca05ca88dfd84054580144d934f730549a4653 The package @posthog/cli was found to contain malicious code. Source: ghsa-malware e663c40b9060088ff86ea24eec083b9b5bf8afdec2e1963895e47e5177a673d1 A...

MAL-2025-190649 Malicious code in posthog-react-native-session-replay (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2487b6f3e3f9f2ef47f2509033fe071b332f5035e1e01320482eea928ae8a120 The package posthog-react-native-session-replay was found to contain malicious code. Source: ghsa-malware...

ShinyHunters Breach Gainsight Apps on Salesforce, Claim Data from 1000 Firms

ShinyHunters breached Gainsight apps integrated with Salesforce, claiming access to data from 1000 firms using stolen credentials and compromised tokens...

ToddyCat: your hidden email assistant. Part 1

Introduction Email remains the main means of business correspondence at organizations. It can be set up either using on-premises infrastructure for example, by deploying Microsoft Exchange Server or through cloud mail services such as Microsoft 365 or Gmail. However, some organizations do not...

Salesforce Flags Unauthorized Data Access via Gainsight-Linked OAuth Activity

Salesforce has warned of detected "unusual activity" related to Gainsight-published applications connected to the platform. "Our investigation indicates this activity may have enabled unauthorized access to certain customers' Salesforce data through the app's connection," the company said in an...

CVE-2025-64762

The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In environments where CDN caching is enable...

CVE-2025-64762 authkit-nextjs may let session cookies be cached in CDNs

The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In environments where CDN caching is enable...

CVE-2025-60794

Session tokens and passwords in couch-auth 0.21.2 are stored in JavaScript objects and remain in memory without explicit clearing in src/user.ts lines 700-707. This creates a window of opportunity for sensitive data extraction through memory dumps, debugging tools, or other memory access...

AuthKit Next.js Library 安全漏洞

AuthKit Next.js Library is a WorkOS open source AuthKit library for Next.js. A security vulnerability exists in AuthKit Next.js Library version 2.11.0 and earlier, which stems from an unapplied anti-caching header that could lead to session token disclosure...

CVE-2025-12427

The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.10.0 via the REST API endpoint and AJAX handler due to missing validation on user-controlled keys. This makes it possible for unauthenticated attackers to...

EUVD-2025-198331

Malicious code in @ra-ftds/ra-flourish-design-tokens npm...

MAL-2025-190588 Malicious code in @ra-ftds/ra-flourish-design-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f72b65d4ce1abb0b35aca62b21968c19b6e8e99ec60962be31a4179ba5f22bec The package @ra-ftds/ra-flourish-design-tokens was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in @ra-ftds/ra-flourish-design-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f72b65d4ce1abb0b35aca62b21968c19b6e8e99ec60962be31a4179ba5f22bec The package @ra-ftds/ra-flourish-design-tokens was found to contain malicious code. Source: ossf-package-analysis...

CVE-2025-62294

SOPlanning is vulnerable to Predictable Generation of Password Recovery Token. Due to weak mechanism of generating recovery tokens, a malicious attacker is able to brute-force all possible values and takeover any account in reasonable amount of time. This issue was fixed in version 1.55...

CVE-2025-62294

SOPlanning is vulnerable to Predictable Generation of Password Recovery Token (CVE-2025-62294). Root cause: weak token generation allows brute-forcing to takeover accounts. Impacted by weakness described as high risk with network attack vector and no user interaction; fixed in version 1.55. Conne...

CVE-2025-62294 Predictable Generation of Password Recovery Token

SOPlanning is vulnerable to Predictable Generation of Password Recovery Token. Due to weak mechanism of generating recovery tokens, a malicious attacker is able to brute-force all possible values and takeover any account in reasonable amount of time. This issue was fixed in version 1.55...