MAL-2025-191871 Malicious code in snapshot-photo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 61ed09e2fa2143dedd945c585d917ad8d7b55d7118e5093430b48c5c02d126f8 This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote...

MAL-2025-191677 Malicious code in alicloud-client-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 59563b61e548ff83488a4940e0511825ebf1a2d0995c83e0056e07fd7a4bd782 This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote...

MAL-2025-191671 Malicious code in aclient-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 aa9e5d91a1f45bce354edc5b12fcacf603db5e00dc4a48628d3fe5fff37d0eb2 This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote...

GHSA-49GW-VXVF-FC2G vulnerabilities

Vulnerabilities for packages: kube-fluentd-operator, vault-k8s, memcached-exporter, supercronic, flux-notification-controller, terragrunt, delve, ferretdb, rabbitmq-default-user-credential-updater, secrets-store-csi-driver-provider-gcp, vexctl, sops, nri-discovery-kubernetes, helm-docs, ollama,...

GHSA-3Q2C-PVP5-3CQP vulnerabilities

Vulnerabilities for packages: envoy-ratelimit, rabbitmq-cluster-operator, kustomize, grpcurl, kubevela, vault-k8s, memcached-exporter, kubernetes-dashboard, supercronic, grype, flux-helm-controller, ytt, helm-operator, delve, rqlite, ferretdb, kubernetes-csi-external-resizer,...

GHSA-7WRW-R4P8-38RX vulnerabilities

Vulnerabilities for packages: kube-fluentd-operator, vault-k8s, memcached-exporter, supercronic, flux-notification-controller, sftpgo-plugin-auth, kapp-controller, delve, kuberlr, ferretdb, secrets-store-csi-driver-provider-gcp, yace, vexctl, nri-discovery-kubernetes, helm-docs,...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: envoy-ratelimit, rabbitmq-cluster-operator, kustomize, grpcurl, kubevela, vault-k8s, memcached-exporter, kubernetes-dashboard, supercronic, grype, flux-helm-controller, ytt, helm-operator, delve, rqlite, ferretdb, kubernetes-csi-external-resizer,...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: envoy-ratelimit, rabbitmq-cluster-operator, kustomize, grpcurl, kubevela, vault-k8s, memcached-exporter, kubernetes-dashboard, supercronic, grype, flux-helm-controller, ytt, helm-operator, delve, rqlite, ferretdb, kubernetes-csi-external-resizer,...

GHSA-797F-63WG-8CHV vulnerabilities

Vulnerabilities for packages: python, aws-cli-v2...

GHSA-JM46-725R-HH9V vulnerabilities

Vulnerabilities for packages: python, aws-cli-v2...

GHSA-JM46-725R-HH9V vulnerabilities

Vulnerabilities for packages: aws-cli-v2, python...

GHSA-32CH-6X54-Q4H9 vulnerabilities

Vulnerabilities for packages: sbom-scorecard, render-template, nri-rabbitmq, pulumi-language-java, wire-go, fuse-overlayfs-snapshotter, bazelisk, etcd, prometheus-mongodb-exporter, secrets-store-csi-driver-provider-azure, vite, kind, cert-exporter-fips, q, aws-load-balancer-controller-fips, fq,...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: sbom-scorecard, render-template, nri-rabbitmq, pulumi-language-java, wire-go, fuse-overlayfs-snapshotter, bazelisk, etcd, prometheus-mongodb-exporter, secrets-store-csi-driver-provider-azure, vite, kind, cert-exporter-fips, q, aws-load-balancer-controller-fips, fq,...

Authentication Bypass

github.com/hashicorp-forge/hermes is vulnerable to Authentication Bypass. The vulnerability is due to improper validation of JWT when using the AWS ALB authentication mode, potentially allowing an authentication bypass attack...

CVE-2025-1293

Hermes versions up to 0.4.0 improperly validated the JWT provided when using the AWS ALB authentication mode, potentially allowing for authentication bypass. This vulnerability, CVE-2025-1293, was fixed in Hermes 0.5.0...

GHSA-VXM9-8MFW-VC6G Hermes improperly validates a JWT

Hermes versions up to 0.4.0 improperly validated the JWT provided when using the AWS ALB authentication mode, potentially allowing for authentication bypass. This vulnerability, CVE-2025-1293, was fixed in Hermes 0.5.0...

Hermes improperly validates a JWT

Hermes versions up to 0.4.0 improperly validated the JWT provided when using the AWS ALB authentication mode, potentially allowing for authentication bypass. This vulnerability, CVE-2025-1293, was fixed in Hermes 0.5.0...

CVE-2025-1293

Hermes versions up to 0.4.0 improperly validated the JWT provided when using the AWS ALB authentication mode, potentially allowing for authentication bypass. This vulnerability, CVE-2025-1293, was fixed in Hermes 0.5.0...

CVE-2025-1293 HashiCorp Hermes Improperly Validates AWS ALB JWTs, which May Lead to Authentication Bypass

Hermes versions up to 0.4.0 improperly validated the JWT provided when using the AWS ALB authentication mode, potentially allowing for authentication bypass. This vulnerability, CVE-2025-1293, was fixed in Hermes 0.5.0...

CVE-2025-1293 HashiCorp Hermes Improperly Validates AWS ALB JWTs, which May Lead to Authentication Bypass

Hermes versions up to 0.4.0 improperly validated the JWT provided when using the AWS ALB authentication mode, potentially allowing for authentication bypass. This vulnerability, CVE-2025-1293, was fixed in Hermes 0.5.0...