Malicious code in tableausdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2facdadd713d6c1751cf3c2ca1e5e76f1cb367c5d30c3f06fe73808c6a08fca3 While described as telemetry, importing the package attempts to send out some basic info as well as quite sensitive environmental variables. --- Category:...

Malicious code in feature-gen-dt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1cb1501cf9b4d2f4476c326f065fbadb057653b09f479cdd836bee84dce76ee1 While described as telemetry, importing the package attempts to send out some basic info as well as quite sensitive environmental variables. --- Category:...

MAL-2025-191884 Malicious code in tableausdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2facdadd713d6c1751cf3c2ca1e5e76f1cb367c5d30c3f06fe73808c6a08fca3 While described as telemetry, importing the package attempts to send out some basic info as well as quite sensitive environmental variables. --- Category:...

MAL-2025-191932 Malicious code in win32con (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b4e7d7a177e3531b4a2566e3c5d1796c1bf18c922bda8943d13e92ef33044141 While described as telemetry, importing the package attempts to send out some basic info as well as quite sensitive environmental variables. --- Category:...

MAL-2025-191877 Malicious code in spyderlib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5c8cd8b0bcebda767e6d2f280c42cfd952522e31086aa816be6b3350611874a1 While described as telemetry, importing the package attempts to send out some basic info as well as quite sensitive environmental variables. --- Category:...

Malicious code in win32con (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b4e7d7a177e3531b4a2566e3c5d1796c1bf18c922bda8943d13e92ef33044141 While described as telemetry, importing the package attempts to send out some basic info as well as quite sensitive environmental variables. --- Category:...

MAL-2025-191879 Malicious code in stubsout (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 288961ef642901bbbd1ecf1fee45702985e9691d3f2fdc95f5990a197df2782b While described as telemetry, importing the package attempts to send out some basic info as well as quite sensitive environmental variables. --- Category:...

MAL-2025-191726 Malicious code in feature-gen-dt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1cb1501cf9b4d2f4476c326f065fbadb057653b09f479cdd836bee84dce76ee1 While described as telemetry, importing the package attempts to send out some basic info as well as quite sensitive environmental variables. --- Category:...

SUSE CVE-2025-48934

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to versions 2.1.13 and 2.2.13, the Deno.env.toObject method ignores any variables listed in the --deny-env option of the deno run command. When looking at the documentation of the --deny-env option this might lead to a false...

GHSA-7W8P-CHXQ-2789 Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables

Summary The Deno.env.toObject method ignores any variables listed in the --deny-env option of the deno run command. When looking at the documentation of the --deny-env option this might lead to a false impression that variables listed in the option are impossible to read. PoC export...

Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables

Summary The Deno.env.toObject method ignores any variables listed in the --deny-env option of the deno run command. When looking at the documentation of the --deny-env option this might lead to a false impression that variables listed in the option are impossible to read. PoC export...

CVE-2025-48934

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to versions 2.1.13 and 2.2.13, the Deno.env.toObject method ignores any variables listed in the --deny-env option of the deno run command. When looking at the documentation of the --deny-env option this might lead to a false...

PT-2025-23841

Name of the Vulnerable Software and Affected Versions Deno versions prior to 2.1.13 and prior to 2.2.13 Description The issue affects Deno, a JavaScript, TypeScript, and WebAssembly runtime. It involves the Deno.env.toObject method, which ignores variables listed in the --deny-env option of the...

Malware in prod-env-variables

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2024-47056

Mautic is affected by CVE-2024-47056, where the .env configuration file can be accessed directly via a web browser due to improper server access controls. This exposure can lead to disclosure of sensitive information, including database credentials, API keys, and other critical configurations. Im...

dcpd Service LPE

The vulnerability of the dcpd service in Siemens Scalance LPE9403 microprogrammed switching devices is related to the use of uninitialized variables. Exploiting this vulnerability could allow a malicious actor to trigger a service failure by sending specially crafted malware packages...

SUSE CVE-2025-48069

ejson2env allows users to decrypt EJSON secrets and export them as environment variables. Prior to version 2.0.8, the ejson2env tool has a vulnerability related to how it writes to stdout. Specifically, the tool is intended to write an export statement for environment variables and their values...

BIT-GITLAB-2025-4979 Insufficient Granularity of Access Control in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. An attacker may be able to reveal masked or hidden CI variables that they did not author in the WebUI, by simply creating their own variable and observing the HTTP...

CVE-2025-4979

An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. An attacker may be able to reveal masked or hidden CI variables that they did not author in the WebUI, by simply creating their own variable and observing the HTTP...

CVE-2025-24362

In some circumstances, debug artifacts uploaded by the CodeQL Action after a failed code scanning workflow run may contain the environment variables from the workflow run, including any secrets that were exposed as environment variables to the workflow. Users with read access to the repository...