Malicious code in amagi-kanban (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8d71615497a724cea51b581b078681fd29f136e4d9338af74fea3692dd35754a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-H33Q-MHMP-8P67 Vyper has a double eval in For List Iter

Multiple evaluation of a single expression is possible in the iterator target of a for loop. While the iterator expression cannot produce multiple writes, it can consume side effects produced in the loop body e.g. read a storage variable updated in the loop body and thus lead to unexpected progra...

Vyper has a double eval in For List Iter

Multiple evaluation of a single expression is possible in the iterator target of a for loop. While the iterator expression cannot produce multiple writes, it can consume side effects produced in the loop body e.g. read a storage variable updated in the loop body and thus lead to unexpected progra...

Vyper's sqrt doesn't define rounding behavior

Vyper's sqrt builtin uses the babylonian method to calculate square roots of decimals. Unfortunately, improper handling of the oscillating final states may lead to sqrt incorrectly returning rounded up results. the fix is tracked in https://github.com/vyperlang/vyper/pull/4486 Vulnerability Detai...

CVE-2025-27104

vyper is a Pythonic Smart Contract Language for the EVM. Multiple evaluation of a single expression is possible in the iterator target of a for loop. While the iterator expression cannot produce multiple writes, it can consume side effects produced in the loop body e.g. read a storage variable...

MAL-2025-191909 Malicious code in transaction-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c1efc9cf33a18e7f3c4294c39aabadf136974e4e2ee56c874ba337ac609c6b77 The only thing the package does is send out all the given data about a cryptocurrency transaction, including the private key, to a hardcoded webhook. Feedback...

CVE-2025-26622 sqrt doesn't define rounding behavior in Vyper

vyper is a Pythonic Smart Contract Language for the EVM. Vyper sqrt builtin uses the babylonian method to calculate square roots of decimals. Unfortunately, improper handling of the oscillating final states may lead to sqrt incorrectly returning rounded up results. This issue is being addressed a...

CVE-2025-26622 sqrt doesn't define rounding behavior in Vyper

vyper is a Pythonic Smart Contract Language for the EVM. Vyper sqrt builtin uses the babylonian method to calculate square roots of decimals. Unfortunately, improper handling of the oscillating final states may lead to sqrt incorrectly returning rounded up results. This issue is being addressed a...

CVE-2025-26622

The CVE concerns vyper’s sqrt() builtin, which uses the Babylonian method for decimals. The problem arises from improper handling of oscillating final states, which can cause sqrt to return a rounded-up value (e.g., for certain inputs, 0.9999999998 → 0.9999999999). The issue is detailed in the GH...

CVE-2025-27104 double eval in For List Iter in Vyper

vyper is a Pythonic Smart Contract Language for the EVM. Multiple evaluation of a single expression is possible in the iterator target of a for loop. While the iterator expression cannot produce multiple writes, it can consume side effects produced in the loop body e.g. read a storage variable...

CVE-2025-27104 double eval in For List Iter in Vyper

vyper is a Pythonic Smart Contract Language for the EVM. Multiple evaluation of a single expression is possible in the iterator target of a for loop. While the iterator expression cannot produce multiple writes, it can consume side effects produced in the loop body e.g. read a storage variable...

CVE-2025-27104 double eval in For List Iter in Vyper

vyper is a Pythonic Smart Contract Language for the EVM. Multiple evaluation of a single expression is possible in the iterator target of a for loop. While the iterator expression cannot produce multiple writes, it can consume side effects produced in the loop body e.g. read a storage variable...

CVE-2025-27104

Vulnerability CVE-2025-27104 affects vyper (Pythonic Smart Contract Language for the EVM): a for-loop iterator target can cause multiple evaluations of the iterator expression, allowing side effects from the loop body to be consumed and interleaved with reads in the loop, leading to unexpected pr...

MAL-2025-1511 Malicious code in spacelift-webhook-receiver (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6bb9dc87c1669be92bee0be50a372fb87d1d92064bc4db257131d4323c2783e9 The OpenSSF Package Analysis project identified 'spacelift-webhook-receiver' @ 1.1.0 npm as malicious. It is considered malicious because: - The...

MAL-2025-1527 Malicious code in wdpr-ra-node-mpropz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 06f859971691a195993b3391bbb8b6a83e269eb750856157e81f65d66c2625cf The OpenSSF Package Analysis project identified 'wdpr-ra-node-mpropz' @ 999.999.999 npm as malicious. It is considered malicious because: - The...

RFC7250 handshakes with unauthenticated servers don't abort as expected

...

BDCOM Behavior Management and Auditing System 操作系统命令注入漏洞

BDCOM Behavior Management and Auditing System is a behavior management and auditing system from BDCOM China. An operating system command injection vulnerability exists in BDCOM Behavior Management and Auditing System version 20250210 and prior versions, which stems from a system command injection...

Vyper 安全漏洞

Vyper is a Pythonic smart contract language for EVM open sourced by vyperlang. A security vulnerability exists in Vyper that stems from multiple evaluations of an iterator expression, which could lead to abnormal program behavior...

MAL-2025-1505 Malicious code in storyblok-rich-text-astro-renderer-workspace (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ca413e5e4f59154a8de4096af868e37c16b2b9df85e5e20a341283c83e7b1db Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Command Execution Vulnerability in Internet Behavior Management System of Tianrongxin Technology Group Co.

Tianrongxin Technology Group Co., Ltd. is a high-tech enterprise focusing on network security and cloud computing solutions. A command execution vulnerability exists in the Internet behavior management system of Tianrongxin Technology Group Company Limited, which can be exploited by attackers to...