MAL-2025-17012 Malicious code in ci_calculator_2024 (npm)

The package cicalculator2024 was found to contain malicious code...

MAL-2025-17150 Malicious code in closure-es6 (npm)

The package closure-es6 was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: google-open-source-security e0574a10de5b6d2bca40b32e3869d3a497db2729667e3523f97b8dde3f5846c7 This package installs a dependency hosted on a custom domain that runs an inf...

MAL-2025-12606 Malicious code in @zalastax/nolb-node-ci (npm)

The package @zalastax/nolb-node-ci was found to contain malicious code...

MAL-2025-12653 Malicious code in @zalastax/nolb-node-red-ci (npm)

The package @zalastax/nolb-node-red-ci was found to contain malicious code...

Malicious code in @zalastax/nolb-node-red-ci (npm)

The package @zalastax/nolb-node-red-ci was found to contain malicious code...

MAL-2025-17011 Malicious code in ci-queue (npm)

The package ci-queue was found to contain malicious code...

MAL-2025-10910 Malicious code in @zalastax/nolb-ci_ (npm)

The package @zalastax/nolb-ci was found to contain malicious code...

CVE-2025-54864

CVE-2025-54864 affects Hydra (Nix-based CI) where the endpoints /api/push-github and /api/push-gitea were called without HTTP Basic authentication, despite the forges implementing HMAC with a secret key. The root cause is missing authentication on those calls, enabling heavy evaluations that can ...

Linux Distros Unpatched Vulnerability : CVE-2022-48908

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: arcnet: com20020: Fix null-ptr-deref in com20020pciprobe During driver initialization, the pointer of card info, i.e. the variable 'ci' is required. Howeve...

MAL-2025-6473 Malicious code in carpentry-ci (PyPI)

--- -= Per source details. Do not edit below this line.=-...

CVE-2025-54415

CVE-2025-54415 affects the dag-factory project (Apache Airflow) for versions ≤ 0.23.0a8. The vulnerability lies in the cicd.yml workflow configured in the astronomer/dag-factory GitHub repository, which, when triggered by pull_request_target, can be exploited to execute arbitrary code in the GitH...

Malicious Package

Overview chime-ci-helper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in chime-ci-helper (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 280ad6fead53ce916eb475c521931d23da0e7ef62e5a88845facf02492123707 Any computer that has this package installed or running should be considered...

MAL-2025-6076 Malicious code in chime-ci-helper (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 280ad6fead53ce916eb475c521931d23da0e7ef62e5a88845facf02492123707 Any computer that has this package installed or running should be considered...

CVE-2025-38189

Technical details about CVE-2025-38189 are not publicly available in the provided Connected documents. The available Initial description contains some information, but no specific affected product/version or impact is confirmed here. Monitor for updated disclosures.

CVE-2025-38189 drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()`

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Avoid NULL pointer dereference in v3djobupdatestats The following kernel Oops was recently reported by Mesa CI: 800.139824 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000588 800.148619 M...

GitLab 17.11 < 17.11.4 / 18.0 < 18.0.2 (CVE-2025-5121)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue that, under certain conditions, could have allowed a successful attacker with authenticated access to a GitLab instance with a GitLab Ultimate license applied paid...

The New Frontline: Why DevOps Became a Cyber Target

Running short on time but still want to stay in the know? Well, we’ve got you covered! We’ve condensed all the key takeaways into a handy audio summary. Our AI-driven podcasts are fit for on the go. Click right here to hear it all on CAASM & CDMB Inefficiencies! Your developers didn't become...

SUSE CVE-2022-50173

In the Linux kernel, the following vulnerability has been resolved: drm/msm/mdp5: Fix global state lock backoff We need to grab the lock after the early return for !hwpipe case. Otherwise, we could have hit contention yet still returned 0. Fixes an issue that the new CONFIGDRMDEBUGMODESETLOCK stu...

CVE-2025-49598

conda-forge-ci-setup is a package installed by conda-forge each time a build is run on CI. The conda-forge-ci-setup-feedstock setup script is vulnerable due to the unsafe use of the eval function when parsing version information from a custom-formatted meta.yaml file. An attacker controlling...