Malware in @gdcorp-commerce/cx-api-connect

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

glib: buffer overflow in set_connect_msg()

A flaw was found in the Glib library. A buffer overflow condition can be triggered in certain conditions due to an off-by-one error in SOCKS4CONNMSGLEN. This issue may lead to an application crash or other undefined behavior...

Security Bulletin: IBM Sterling Connect:Direct for Microsoft Windows is vulnerable to multiple issues due to IBM Runtime Environment Java Technology Edition Version 8

Summary There are vulnerabilities in IBM Runtime Environment Java Technology Edition Version 8 used by IBM Sterling Connect:Direct for Microsoft Windows. IBM Sterling Connect:Direct for Microsoft Windows has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2025-21587 DESCRIPTION: An...

glib: buffer overflow in set_connect_msg()

A flaw was found in the Glib library. A buffer overflow condition can be triggered in certain conditions due to an off-by-one error in SOCKS4CONNMSGLEN. This issue may lead to an application crash or other undefined behavior...

CVE-2024-42648

NanoMQ v0.22.10 was discovered to contain a heap overflow which allows attackers to cause a Denial of Service DoS via a crafted CONNECT message...

CVE-2024-42648: Out-of-bounds Write

NanoMQ v0.22.10 was discovered to contain a heap overflow which allows attackers to cause a Denial of Service DoS via a crafted CONNECT message...

Exploit for Stack-based Buffer Overflow in Ivanti Connect_Secure

CVE-2025-22457: Critical Ivanti Connect Secure Vulnerability ⚡...

CVE-2025-31267

An authentication issue was addressed with improved state management. This issue is fixed in App Store Connect 3.0. An attacker with physical access to an unlocked device may be able to view sensitive user information...

CVE-2025-6549

An Incorrect Authorization vulnerability in the web server of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to reach the Juniper Web Device Manager J-Web. When Juniper Secure connect JSC is enabled on specific interfaces, or multiple interfaces are...

Security update for docker

This update for docker fixes the following issues: Update to Docker 28.2.2-ce bsc1243833, bsc1242114: CVE-2025-0495: Fixed credential leakage to telemetry endpoints when credentials allowed to be set as attribute values in cache-to/cache-from configuration.bsc1239765 CVE-2025-22872:...

org.mitre:openid-connect-client (>=1.0.1, <=1.0.11), org.mitre:openid-connect-common (>=1.0.1, <=1.0.11) +2 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (2.15.2)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.mitre:openid-connect-client =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.11 Source cves: CVE-2025-53864...

com.nimbusds:oauth2-oidc-sdk (>=3.4, <=3.4.1), com.nimbusds:oidc-claims-source-ldap (>=1.2.7, <=1.2.9) +10 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (2.26.1)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.26.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.nimbusds:oauth2-oidc-sdk =3.4, =1.2.7, =1.2.7, =1.1.9, =1.1.9, =1.1.9, =1.1.9, =1.7.0, =4.3.1,...

org.mitre:openid-connect-client (>=0.9.0, <=0.9.1), org.mitre:openid-connect-common (>=0.9.0, <=0.9.1) +2 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (2.13.0)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.mitre:openid-connect-client =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.1 Source cves: CVE-2025-53864...

org.mitre:openid-connect-client (>=0.9.2, <=1.0.0), org.mitre:openid-connect-common (>=0.9.2, <=1.0.0) +2 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (2.13.1)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.mitre:openid-connect-client =0.9.2, =0.9.2, =0.9.2, =0.9.2, =1.0.0 Source cves: CVE-2025-53864...

org.mitre:openid-connect-client (>=1.0.12, <=1.1.0), org.mitre:openid-connect-common (>=1.0.12, <=1.1.0) +3 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (2.17.2)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.17.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.mitre:openid-connect-client =1.0.12, =1.0.12, =1.0.12, =1.0.12, =1.1.0 -...

com.microsoft.aad:adal4j (0.0.1), com.nimbusds:oauth2-oidc-sdk (>=2.14.2, <=3.0) +7 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (2.22.1)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.22.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.microsoft.aad:adal4j 0.0.1 - com.nimbusds:oauth2-oidc-sdk =2.14.2, =1.2, =1.2, =1.24.0, =1.1.1,...

com.atlassian.connect:atlassian-connect-spring-boot-core (>=0.9.0-alpha, <=1.3.6), com.atlassian.connect:atlassian-connect-spring-boot-jwt (>=0.9.0-alpha, <=1.3.6) +3 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (3.6)

com.nimbusds:nimbus-jose-jwt MAVEN version 3.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.atlassian.connect:atlassian-connect-spring-boot-core =0.9.0-alpha, =0.9.0-alpha, =0.9.0-alpha,...

com.atlassian.connect:atlassian-connect-spring-boot-core (>=2.1.8, <=2.2.1), com.atlassian.connect:atlassian-connect-spring-boot-jwt (>=2.1.8, <=2.2.1) +131 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (8.20.2)

com.nimbusds:nimbus-jose-jwt MAVEN version 8.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.atlassian.connect:atlassian-connect-spring-boot-core =2.1.8, =2.1.8, =2.1.8, =3.4.0, =3.3.0,...

com.github.allantl:atlassian-connect-http4s_2.12 (>=0.1.0, <=0.1.2), com.github.allantl:jira4s_2.12 (0.2.0) +291 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (7.1)

com.nimbusds:nimbus-jose-jwt MAVEN version 7.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.github.allantl:atlassian-connect-http4s2.12 =0.1.0, =1.4, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0...

Adobe Connect <= 24 Arbitrary Code Execution Vulnerability (APSB25-61)

The version of Adobe Connect installed on the remote host is prior to 25.1. It is, therefore, affected by a vulnerability as referenced in the apsb25-61 advisory. - Adobe Connect versions 24.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could lead to arbitra...