MAL-2025-2562 Malicious code in com.unity.performance.profile-analyzer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0af641db458fc7a8378ef6660e94aa21d6e8a8662aa90cc72412d909765b39d0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-0254 HCL Digital Experience components Ring API and dxclient may be vulnerable to man-in-the-middle (MitM) attacks prior to 9.5 CF226.

HCL Digital Experience components Ring API and dxclient may be vulnerable to man-in-the-middle MitM attacks prior to 9.5 CF226. An attacker could intercept and potentially alter communication between two parties...

Malicious code in chatbot-dashboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5af371ce3024a5ed217ff2baf8b2a9443cf92ae8a1993552e3679be6f83698a5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2543 Malicious code in azure-rest-api-specs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9b45f4b5db07c14af82f92638c97d70419c7936860274a00dbea1e18db0b58f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in azure-rest-api-specs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9b45f4b5db07c14af82f92638c97d70419c7936860274a00dbea1e18db0b58f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2542 Malicious code in tag-soup-ng (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5c6f3d943d58e767428be21a9044b8969fbf56027da115be523bd13e0af23d36 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

USN-7358-1: PostgreSQL vulnerabilities

Wolfgang Walther discovered that PostgreSQL incorrectly tracked tables with row security. A remote attacker could possibly use this issue to perform forbidden reads and modifications. CVE-2024-10976 Jacob Champion discovered that PostgreSQL clients used untrusted server error messages. An attacke...

Data Leaks and AI Agents: Why Your APIs Could Be Exposing Sensitive Information

Most organizations are using AI in some way today, whether they know it or not. Some are merely beginning to experiment with it, using tools like chatbots. Others, however, have integrated agentic AI directly into their business procedures and APIs. While both types of organizations are undoubted...

MAL-2025-2487 Malicious code in ppcardmanagementv2serv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 740efd22ccbe878eaf1d6aadf620e5282db9c179601a6034300d1fd78ef01218 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in militaty-geza-blessed2025hondo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9f68cc04dd7a67be9ecd2b61249ad24d3e6b39c02fd0195aa04d3e1652294da0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sendmoneyserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 22431b45239f04c82c7ad749764ff1a438263e5fb1fa13236061aecdd49bf1b0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-29913

CVE-2025-29913 affects CryptoLib (versions ≤ 1.3.3). The vulnerability is in the function Crypto_TC_Prep_AAD, where an incorrect calculation of the MAC start index can underflow an unsigned integer, causing an out-of-bounds access in the ingest buffer and leading to a heap-based buffer overflow. ...

MAL-2025-2449 Malicious code in real-world1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c283f503b8625f549d7d7eae7699333b3d1ecf140d4aded77c129247c0ba1217 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2448 Malicious code in @flutterfire/source-ui-widgets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d5007a2c3f744fc79ba88f20dcf5897470581ccbb3a076b83a10d43ad9c6f5e7 The OpenSSF Package Analysis project identified '@flutterfire/source-ui-widgets' @ 1.0.0 npm as malicious. It is considered malicious because: -...

CVE-2023-33300

A improper neutralization of special elements used in a command 'command injection' in Fortinet FortiNAC 7.2.1 and earlier, 9.4.3 and earlier allows attacker a limited, unauthorized file access via specifically crafted request in inter-server communication port...

CVE-2025-27594

The device uses an unencrypted, proprietary protocol for communication. Through this protocol, configuration data is transmitted and device authentication is performed. An attacker can thereby intercept the authentication hash and use it to log into the device using a pass-the-hash attack...

Malicious code in ionicaiosampleapp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ae3e09f0b7537140686ef5504c21e18b301f44e502feb68aad99bd4c5346a876 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2440 Malicious code in whatsapp-sdk-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 788206c160622c7c87f5e0b19b4be9383f89a8918fa3aace86ec99350a06daa4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2439 Malicious code in starrocks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d61ee110d66f318505d0819f7b6e5ebf2b3767911b91e2748bdf5a911decbcb2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-33300

A improper neutralization of special elements used in a command 'command injection' in Fortinet FortiNAC 7.2.1 and earlier, 9.4.3 and earlier allows attacker a limited, unauthorized file access via specifically crafted request in inter-server communication port...