GHSA-77H3-W9RX-HJ3Q User-defined implementations of the safe trait scratchpad::Tracking can cause heap buffer overflows

The get and set methods of the public trait scratchpad::Tracking interact with unsafe code regions in the crate, and they influence the computation of addresses returned as raw pointers. However, the trait itself is not marked as unsafe, meaning users may provide custom implementations under the...

User-defined implementations of the safe trait scratchpad::Tracking can cause heap buffer overflows

The get and set methods of the public trait scratchpad::Tracking interact with unsafe code regions in the crate, and they influence the computation of addresses returned as raw pointers. However, the trait itself is not marked as unsafe, meaning users may provide custom implementations under the...

Malicious code in ava-ilable-down-load-mp3-today-15541-troubled-shaken-etc-0oakd-xtjnkz (npm)

The package ava-ilable-down-load-mp3-today-15541-troubled-shaken-etc-0oakd-xtjnkz was found to contain malicious code...

Malicious code in await-pavo-glaciology-axios (npm)

The package await-pavo-glaciology-axios was found to contain malicious code...

Malicious code in juhuwai (npm)

The package juhuwai was found to contain malicious code...

Malicious code in prairie_jdjve_izhuv_fern (npm)

The package prairiejdjveizhuvfern was found to contain malicious code...

MAL-2025-22515 Malicious code in homematic-js-km200 (npm)

The package homematic-js-km200 was found to contain malicious code...

Malicious code in @zalastax/nolb-m- (npm)

The package @zalastax/nolb-m- was found to contain malicious code...

Malicious code in test-mlw2-mauls-chewy (npm)

The package test-mlw2-mauls-chewy was found to contain malicious code...

Malicious code in mp3-do-wnload-file-to-day-take-them-on-on-your-own-hrfix-cczgww (npm)

The package mp3-do-wnload-file-to-day-take-them-on-on-your-own-hrfix-cczgww was found to contain malicious code...

Malicious code in pino-pretty-flare-zephyr-sirius (npm)

The package pino-pretty-flare-zephyr-sirius was found to contain malicious code...

MAL-2025-16327 Malicious code in builder-new (npm)

The package builder-new was found to contain malicious code...

CVE-2025-55010

Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.47, an unsafe deserialization vulnerability in the ProjectEventActvityFormatter allows admin users the ability to instantiate arbitrary php objects by modifying the event"data" field in the...

CVE-2025-55192

HomeAssistant-Tapo-Control exposes a code injection vulnerability in its GitHub Actions workflow .github/workflows/issues.yml, prior to commit 2a3b80f. The workflow directly inserts user-controlled content from the issue body (github.event.issue.body) into a Bash conditional without proper saniti...

CVE-2025-7971

A security issues exists within Studio 5000 Logix Designer due to unsafe handling of environment variables. If the specified path lacks a valid file, Logix Designer crashes; However, it may be possible to execute malicious code without triggering a crash...

CVE-2025-7971 Studio 5000 Logix Designer® – Arbitrary Code Execution Vulnerability

A security issues exists within Studio 5000 Logix Designer due to unsafe handling of environment variables. If the specified path lacks a valid file, Logix Designer crashes; However, it may be possible to execute malicious code without triggering a crash...

CVE-2025-7971 Studio 5000 Logix Designer® – Arbitrary Code Execution Vulnerability

A security issues exists within Studio 5000 Logix Designer due to unsafe handling of environment variables. If the specified path lacks a valid file, Logix Designer crashes; However, it may be possible to execute malicious code without triggering a crash...

GHSA-Q4XX-MC3Q-23X8 Duplicate Advisory: Flowise vulnerable to RCE via Dynamic function constructor injection

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hmgh-466j-fx4c. This link is maintained to preserve external references. Original Description User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers...

RUSTSEC-2025-0050 IdMap::from_iter may lead to uninitialized memory being freed on drop

Due to a flaw in the constructor idmap::IdMap::fromiter, ill-formed objects may be created in which the amount of actually initialized memory is less than what is expected by the fields of IdMap. Specifically, the field ids is initialized based on the capacity of the vector values, which is...

User-defined implementations of the safe trait scratchpad::Tracking can cause heap buffer overflows

The get and set methods of the public trait scratchpad::Tracking interact with unsafe code regions in the crate, and they influence the computation of addresses returned as raw pointers. However, the trait itself is not marked as unsafe, meaning users may provide custom implementations under the...