Malicious code in ing-feat-auth-idin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55080ac00ebd2c937db80d93324226b3fbb9dda607619f44d94dd4c09a8ba0fc The package ing-feat-auth-idin was found to contain malicious code. Source: ghsa-malware...

MAL-2025-192933 Malicious code in ing-feat-auth-idin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55080ac00ebd2c937db80d93324226b3fbb9dda607619f44d94dd4c09a8ba0fc The package ing-feat-auth-idin was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-205385

Malicious code in ing-feat-auth-idin npm...

MAL-2025-192712 Malicious code in auth-handler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79d1be042f1565157d9c5e97b927919aa32bedb254b501aa374caf00c242ee83 The package auth-handler was found to contain malicious code...

EUVD-2025-204941

Malicious code in auth-handler npm...

Malicious code in auth-handler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79d1be042f1565157d9c5e97b927919aa32bedb254b501aa374caf00c242ee83 The package auth-handler was found to contain malicious code...

fastapi-toolkit-shawn587 (>=0.2.1.3, <=0.2.2.0), fps-auth (>=0.2.0, <=0.4.2) +2 more potentially affected by CVE-2025-68481 via fastapi-users (12.1.3)

fastapi-users PYPI version 12.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - fastapi-toolkit-shawn587 =0.2.1.3, =0.2.0, =1.4.0a9, =0.4.1, =0.5.1 Source cves: CVE-2025-68481 Source advisory: OSV:GHSA-5J53-63W8-8...

fastapi-users-with-username (13.0.0.post1), fps-auth (>=0.5.0, <=0.7.1) +1 more potentially affected by CVE-2025-68481 via fastapi-users (13.0.0)

fastapi-users PYPI version 13.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - fastapi-users-with-username 13.0.0.post1 - fps-auth =0.5.0, =0.7.1 - guardianhub-core 0.1.0 Source cves: CVE-2025-68481 Source...

defi-common (>=0.1.5, <=0.1.96), fps-auth (>=0.0.38, <=0.1.4) +1 more potentially affected by CVE-2025-68481 via fastapi-users (10.4.2)

fastapi-users PYPI version 10.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - defi-common =0.1.5, =0.0.38, =1.3.0a1, =1.3.5 Source cves: CVE-2025-68481 Source advisory: OSV:GHSA-5J53-63W8-8625...

dataset-image-annotator (0.0.19), fastapi-auth-service (>=0.0.3, <=0.0.7) potentially affected by CVE-2025-68481 via fastapi-users (10.2.1)

fastapi-users PYPI version 10.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - dataset-image-annotator 0.0.19 - fastapi-auth-service =0.0.3, =0.0.7 Source cves: CVE-2025-68481 Source advisory:...

fief-server (>=0.24.8, <=0.25.3), fps-auth (>=0.1.5, <=0.1.10) +1 more potentially affected by CVE-2025-68481 via fastapi-users (11.0.0)

fastapi-users PYPI version 11.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - fief-server =0.24.8, =0.1.5, =0.8.0, =0.9.0 Source cves: CVE-2025-68481 Source advisory: OSV:GHSA-5J53-63W8-8625...

CVE-2025-14964

A vulnerability has been found in TOTOLINK T10 4.1.8cu.5083B20200521. This affects the function sprintf of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument loginAuthUrl leads to stack-based buffer overflow. The attack may be performed from remote...

CVE-2025-14964

A vulnerability has been found in TOTOLINK T10 4.1.8cu.5083B20200521. This affects the function sprintf of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument loginAuthUrl leads to stack-based buffer overflow. The attack may be performed from remote...

Security update for salt

This update for salt fixes the following issues: Security issues fixed: CVE-2025-62349: Added minimumauthversion to enforce security bsc1254257 CVE-2025-62348: Fixed Junos module yaml loader bsc1254256 Backport security fixes for vendored tornado BDSA-2024-3438 BDSA-2024-3439 BDSA-2024-9026 Other...

libceph: prevent potential out-of-bounds writes in handle_auth_session_key()

...

Security update 5.1.1.1 for Multi-Linux Manager Client Tools

This update fixes the following issues: grafana was updated from version 11.5.7 to 11.5.10: Security issues fixed: CVE-2025-64751: Drop experimental implementation of authorization Zanzana server/client version 11.5.10 bsc1254113 CVE-2025-47911: Fix parsing HTML documents version 11.5.10 bsc12514...

Server-side Request Forgery (SSRF)

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the apiURL parameter in authData used by the Instagram OAuth adapter. An attacker can...

EUVD-2025-203845

Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass disabledPaths Config and Rate Limits...

Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass disabledPaths Config and Rate Limits

Summary An issue in the underlying router library rou3 can cause /path and //path to be treated as identical routes. If your environment does not normalize incoming URLs e.g., by collapsing multiple slashes, this can allow bypasses of disabledPaths and path-based rate limits. Details Better Auth...

@alstar/studio (0.0.0-beta.20), @better-auth/cli (>=1.0.0-canary.2, <=1.4.4) +65 more potentially affected by unknown CVE via better-auth (>=1.0.0-canary.2, <=1.4.4)

better-auth NPM version =1.0.0-canary.2, =1.0.0-canary.2, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.26, =1.3.27, =0.18.0, =0.5.2, =1.0.2, =1.0.2, =1.0.2, =1.0.3 and more Source cves: unknown CVE Source advisory: GHSA-X732-6J76-QMHM...