Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the url parameter in the /api/images/cache endpoint. An attacker can cause the server to download arbitrary content by supplying a crafted URL. This is only exploitable if the attacker is an...

CVE-2025-43443

This issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash...

Malicious code in pc-experience-fe-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8257ed048a6a07820b94cb55bada5ee260ab483c75647da8c506236aa890e7e5 The package pc-experience-fe-components was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-37539

Malicious code in pc-experience-fe-components npm...

MAL-2025-49342 Malicious code in pc-experience-fe-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8257ed048a6a07820b94cb55bada5ee260ab483c75647da8c506236aa890e7e5 The package pc-experience-fe-components was found to contain malicious code. Source: ghsa-malware...

[SECURITY] Fedora 43 Update: unbound-1.24.1-1.fc43

Unbound is a validating, recursive, and caching DNSSEC resolver. The C implementation of Unbound is developed and maintained by NLnet Labs. It is based on ideas and algorithms taken from a java prototype developed by Verisign labs, Nominet, Kirei and ep.net. Unbound is designed as a set of modula...

Unspecified Vulnerability in Azure Access Technology BLU-IC2 and Azure Access Technology BLU-IC4 (CNVD-2025-29087)

The Azure Access Technology BLU-IC2 and Azure Access Technology BLU-IC4 are both networked access controllers from Azure Access Technology, USA. A security vulnerability exists in Azure Access Technology BLU-IC2 and Azure Access Technology BLU-IC4, which is caused by the use of vulnerable...

Malicious code in epic-diesel-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c845610e9f2b712b89218940faed5b186517dacfde23d4dda9d95833b3cdb9a4 The package epic-diesel-components was found to contain malicious code...

Malicious code in epic-ue-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8be8aaeadc65eecac5d97a903d0ab829cbce32f8b021d50552e1d584a5329237 The package epic-ue-components was found to contain malicious code...

MAL-2025-49133 Malicious code in epic-diesel-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c845610e9f2b712b89218940faed5b186517dacfde23d4dda9d95833b3cdb9a4 The package epic-diesel-components was found to contain malicious code...

MAL-2025-49201 Malicious code in epic-ue-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8be8aaeadc65eecac5d97a903d0ab829cbce32f8b021d50552e1d584a5329237 The package epic-ue-components was found to contain malicious code...

EUVD-2025-37092

Malicious code in epic-ue-components npm...

EUVD-2025-37160

Malicious code in epic-diesel-components npm...

Security Bulletin: IBM QRadar Hub for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM QRadar Hub for IBM QRadar SIEM has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2025-58754 DESCRIPTION: Axios is a promise based HTTP clien...

[SECURITY] Fedora 42 Update: qt6-qttools-6.9.3-1.fc42

Qt6 - QtTool components...

[SECURITY] Fedora 42 Update: qt6-qtwebengine-6.9.3-1.fc42

Qt6 - QtWebEngine components...

[SECURITY] Fedora 42 Update: qt6-qtconnectivity-6.9.3-1.fc42

Qt6 - Connectivity components...

Malicious Package

Overview geopost-angular-components is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

EUVD-2025-36885

Malicious code in geopost-angular-components npm...

UBUNTU-CVE-2025-61725

The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption...