GitLab < 18.1.5 / 18.2 < 18.2.5 / 18.3 < 18.3.1 (CVE-2025-2246)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab CE/EE affecting all versions before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that could have allowed unauthenticated users to access sensitive manual...

Malicious code in @zalastax/nolb-ci_ (npm)

The package @zalastax/nolb-ci was found to contain malicious code...

Malicious code in @zalastax/nolb-node-red-ci (npm)

The package @zalastax/nolb-node-red-ci was found to contain malicious code...

Malicious code in ci-queue (npm)

The package ci-queue was found to contain malicious code...

MAL-2025-12653 Malicious code in @zalastax/nolb-node-red-ci (npm)

The package @zalastax/nolb-node-red-ci was found to contain malicious code...

MAL-2025-17012 Malicious code in ci_calculator_2024 (npm)

The package cicalculator2024 was found to contain malicious code...

MAL-2025-12606 Malicious code in @zalastax/nolb-node-ci (npm)

The package @zalastax/nolb-node-ci was found to contain malicious code...

MAL-2025-10910 Malicious code in @zalastax/nolb-ci_ (npm)

The package @zalastax/nolb-ci was found to contain malicious code...

MAL-2025-17150 Malicious code in closure-es6 (npm)

The package closure-es6 was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: google-open-source-security e0574a10de5b6d2bca40b32e3869d3a497db2729667e3523f97b8dde3f5846c7 This package installs a dependency hosted on a custom domain that runs an inf...

MAL-2025-17011 Malicious code in ci-queue (npm)

The package ci-queue was found to contain malicious code...

CVE-2025-55192: Improper Control of Generation of Code

HomeAssistant-Tapo-Control offers Control for Tapo cameras as a Home Assistant component. Prior to commit 2a3b80f, there is a code injection vulnerability in the GitHub Actions workflow .github/workflows/issues.yml. It does not affect users of the Home Assistant integration itself — it only impac...

CVE-2025-54864

CVE-2025-54864 affects Hydra (Nix-based CI) where the endpoints /api/push-github and /api/push-gitea were called without HTTP Basic authentication, despite the forges implementing HMAC with a secret key. The root cause is missing authentication on those calls, enabling heavy evaluations that can ...

Linux Distros Unpatched Vulnerability : CVE-2022-48908

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: arcnet: com20020: Fix null-ptr-deref in com20020pciprobe During driver initialization, the pointer of card info, i.e. the variable 'ci' is required. Howeve...

MAL-2025-6473 Malicious code in carpentry-ci (PyPI)

--- -= Per source details. Do not edit below this line.=-...

CVE-2025-54415

CVE-2025-54415 affects the dag-factory project (Apache Airflow) for versions ≤ 0.23.0a8. The vulnerability lies in the cicd.yml workflow configured in the astronomer/dag-factory GitHub repository, which, when triggered by pull_request_target, can be exploited to execute arbitrary code in the GitH...

Malicious Package

Overview chime-ci-helper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malware in chime-ci-helper

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in chime-ci-helper (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 280ad6fead53ce916eb475c521931d23da0e7ef62e5a88845facf02492123707 Any computer that has this package installed or running should be considered...

MAL-2025-6076 Malicious code in chime-ci-helper (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 280ad6fead53ce916eb475c521931d23da0e7ef62e5a88845facf02492123707 Any computer that has this package installed or running should be considered...

CVE-2025-38189

Technical details about CVE-2025-38189 are not publicly available in the provided Connected documents. The available Initial description contains some information, but no specific affected product/version or impact is confirmed here. Monitor for updated disclosures.