CVE-2025-11953

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary...

Malicious code in replit_ruspty (crates.io)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 703ba59c0f40f937ba922d389d8beab406cc57110b792ed8d58ab7e8133c1712 The OpenSSF Package Analysis project identified 'replitruspty' @ 1.0.0 crates.io as malicious. It is considered malicious because: - The package...

MAL-2025-49350 Malicious code in replit_ruspty (crates.io)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 703ba59c0f40f937ba922d389d8beab406cc57110b792ed8d58ab7e8133c1712 The OpenSSF Package Analysis project identified 'replitruspty' @ 1.0.0 crates.io as malicious. It is considered malicious because: - The package...

CVE-2025-27070

Memory corruption while performing encryption and decryption commands...

CVE-2025-27064 Buffer Over-read in Core Services

Information disclosure while registering commands from clients with diag through diagHal...

Qualcomm Chipsets 缓冲区错误漏洞

Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated USA. A buffer error vulnerability exists in Qualcomm Chipsets that originates from a memory corruption when executing encryption and decryption commands...

Qualcomm Chipsets 安全漏洞

Qualcomm Chipsets are a family of chipsets from Qualcomm, an American company. A security vulnerability exists in Qualcomm Chipsets that stems from an information disclosure when registering client commands via diagHal...

@react-native-community/cli has arbitrary OS command injection

The Metro Development Server, which is opened by the React Native CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary...

EUVD-2025-37505

The Metro Development Server, which is opened by the React Native CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary...

CVE-2025-11953

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary...

CVE-2025-11953 Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary...

CVE-2025-11953 Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary...

CVE-2025-11953 Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary...

Malicious code in webswing-directdraw-javascript (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e79387f18b95e5ef7af4d75095dd85e7dedcff2c1e2a068795989cc559bbc695 The package webswing-directdraw-javascript was found to contain malicious code. Source: ossf-package-analysis...

MAL-2025-49309 Malicious code in webswing-directdraw-javascript (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e79387f18b95e5ef7af4d75095dd85e7dedcff2c1e2a068795989cc559bbc695 The package webswing-directdraw-javascript was found to contain malicious code. Source: ossf-package-analysis...

MAL-2025-49315 Malicious code in mbed-js-ble (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46cbc9bfb6de04bcef9b700b14e7b05e13889f71d3fd11d9ba0281cc76d95f39 The package mbed-js-ble was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in mbed-js-ble (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46cbc9bfb6de04bcef9b700b14e7b05e13889f71d3fd11d9ba0281cc76d95f39 The package mbed-js-ble was found to contain malicious code. Source: ossf-package-analysis...

MAL-2025-49312 Malicious code in ethers-5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8842d229aa4e9c24c85ce8a9be99c6690dbf62bef2bdf2ef716865c8a44adda3 The package ethers-5 was found to contain malicious code. Source: ossf-package-analysis...

MAL-2025-49319 Malicious code in web3-1-4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8b0f3301c4d4556f7e8700121e0fa272e12f9fa0f75868720564356cdde51ed The package web3-1-4 was found to contain malicious code. Source: ossf-package-analysis...

MAL-2025-49311 Malicious code in balancer-labs-sor-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 913cc298291011f049211a4379e100f5ca724f09b512b5fdfcc84fd0f1df3caa The package balancer-labs-sor-v1 was found to contain malicious code. Source: ossf-package-analysis...