MAL-2025-48453 Malicious code in src_pages_list_index_tsx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 191404621c42806b5e14f38b5dd6674109c26eb03902fa54c23312ee369c6d72 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48451 Malicious code in helosifjowe2342 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6ff27da2ff03d6b016cef58dfffd401cb2f19e84cf787613903f36a4b834a7c3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in helosifjowe2342 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6ff27da2ff03d6b016cef58dfffd401cb2f19e84cf787613903f36a4b834a7c3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cp2-shared-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e522530df817242e07e68b2cb283eb4e70763b4ba8d248c97791fab28dc67887 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48450 Malicious code in cp2-shared-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e522530df817242e07e68b2cb283eb4e70763b4ba8d248c97791fab28dc67887 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Command Injection

Hoverfly is vulnerable to Command Injection. The vulnerability is due to improper input validation in the middleware endpoint due to the binary and script parameters being passed directly into a system without sanitization. This allows an attacker to supply crafted values for those parameters to...

Security update for chrony

This update for chrony fixes the following issues: Update to version 4.8: Add maxunreach option to limit selection of unreachable sources Add -u option to chronyc to drop root privileges default chronyc user is set by configure script Fix refclock extpps option to work on Linux = 6.15 Validate...

EUVD-2025-34858

The iSherlock developed by HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server...

F5 BIG-IP Elevation of Privilege Vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, and remote access policy management. An elevation of privilege vulnerability exists in the BIG-IP's iControl REST and TMOS Shell tmsh modules. The vulnerability...

CVE-2025-34514

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain authenticated OS command injection vulnerabilities in multiple web-accessible PHP scripts that call exec and allow an authenticated attacker to execute arbitrary commands. Ilevia has declined to service this vulnerability, and...

CVE-2025-62378

CommandKit is the discord.js meta-framework for building Discord bots. In versions 1.2.0-rc.1 through 1.2.0-rc.11, a logic flaw exists in the message command handler that affects how the commandName property is exposed to both middleware functions and command execution contexts when handling...

CVE-2025-53868

When running in Appliance mode, a highly privileged authenticated attacker with access to SCP and SFTP may be able to bypass Appliance mode restrictions using undisclosed commands. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

BIT-VALKEY-2025-32023 Redis allows out of bounds writes in hyperloglog commands leading to RCE

Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog operations, potentially leading to remote code execution. The...

BIT-REDIS-2025-32023 Redis allows out of bounds writes in hyperloglog commands leading to RCE

Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog operations, potentially leading to remote code execution. The...

MAL-2025-48437 Malicious code in hyperion-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b9ccc060b3a05f5422ec317fc83c828522f43b1b0b2ce916d1c5d72bf082366 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in hyperion-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b9ccc060b3a05f5422ec317fc83c828522f43b1b0b2ce916d1c5d72bf082366 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48433 Malicious code in corp-ais-client-my-channel-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6a5c6a2e2c6632d11abe65b902c4dee848386ec4240aba0fee8f76983ac4ff56 The OpenSSF Package Analysis project identified 'corp-ais-client-my-channel-lib' @ 99.9.10 npm as malicious. It is considered malicious because:...

Malicious code in corp-ais-client-my-channel-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6a5c6a2e2c6632d11abe65b902c4dee848386ec4240aba0fee8f76983ac4ff56 The OpenSSF Package Analysis project identified 'corp-ais-client-my-channel-lib' @ 99.9.10 npm as malicious. It is considered malicious because:...

Malicious code in company-browser-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7621dd08044aeaacb68745078c793611d91031eb9852f8f667f739d485efe939 The OpenSSF Package Analysis project identified 'company-browser-package' @ 99.9.10 npm as malicious. It is considered malicious because: - The...

Malicious code in internal-plugin-lifecycle-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 332aa89488a5ecb7012588f98648ef97de374565f906dfc69ff80d4d344e9a03 The OpenSSF Package Analysis project identified 'internal-plugin-lifecycle-card' @ 99.9.10 npm as malicious. It is considered malicious because:...