EUVD-2025-54855

Malicious code in distinctive-aqua-crayfish npm...

EUVD-2025-49017

Malicious code in woodencrayfishz3n npm...

EUVD-2025-50533

Malicious code in completecrayfishz3n npm...

EUVD-2025-49984

Malicious code in innocentcrayfishz3n npm...

Malicious code in hushed_crayfish_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 926f3834798686240b93486b3bc7629e9dbb165f356ec7dc07b4427e3b28d846 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wooden_crayfish_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20edd740961dd674432f945b4c58912dcf24f51864dfe59186e32957f19c05b5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-4100

Malicious code in bioql PyPI...

EUVD-2025-0100

Malicious code in bioql PyPI...

EUVD-2025-4966

Malicious code in bioql PyPI...

CVE-2025-25286

Crayfish is a collection of Islandora 8 microservices, one of which, Homarus, provides FFmpeg as a microservice. Prior to Crayfish version 4.1.0, remote code execution may be possible in web-accessible installations of Homarus in certain configurations. The issue has been patched in...

CVE-2025-25286

Crayfish is a collection of Islandora 8 microservices, one of which, Homarus, provides FFmpeg as a microservice. Prior to Crayfish version 4.1.0, remote code execution may be possible in web-accessible installations of Homarus in certain configurations. The issue has been patched in...

CVE-2025-25286 Crayfish allows Remote Code Execution via Homarus Authorization header

Crayfish is a collection of Islandora 8 microservices, one of which, Homarus, provides FFmpeg as a microservice. Prior to Crayfish version 4.1.0, remote code execution may be possible in web-accessible installations of Homarus in certain configurations. The issue has been patched in...

CVE-2025-25286

Crayfish is a collection of Islandora 8 microservices, one of which, Homarus, provides FFmpeg as a microservice. Prior to Crayfish version 4.1.0, remote code execution may be possible in web-accessible installations of Homarus in certain configurations. The issue has been patched in...

CVE-2025-25286

CVE-2025-25286 affects Crayfish’s Homarus FFmpeg microservice. Prior to Crayfish 4.1.0, remote code execution could occur in web-accessible installations in certain configurations. The issue has been patched in islandora/crayfish:4.1.0. Workarounds include preventing Internet access to Homarus or...

CVE-2025-25286 Crayfish allows Remote Code Execution via Homarus Authorization header

Crayfish is a collection of Islandora 8 microservices, one of which, Homarus, provides FFmpeg as a microservice. Prior to Crayfish version 4.1.0, remote code execution may be possible in web-accessible installations of Homarus in certain configurations. The issue has been patched in...

CVE-2025-25286 Crayfish allows Remote Code Execution via Homarus Authorization header

Crayfish is a collection of Islandora 8 microservices, one of which, Homarus, provides FFmpeg as a microservice. Prior to Crayfish version 4.1.0, remote code execution may be possible in web-accessible installations of Homarus in certain configurations. The issue has been patched in...

Crayfish 安全漏洞

Crayfish is a collection of Islandora microservices open-sourced by Islandora. A security vulnerability exists in Crayfish that stems from remote code execution that can occur in Homarus installations that are accessible via the Web under certain configurations...

CVE-2025-25286: Improper Neutralization of Escape, Meta, or Control Sequences

Crayfish is a collection of Islandora 8 microservices, one of which, Homarus, provides FFmpeg as a microservice. Prior to Crayfish version 4.1.0, remote code execution may be possible in web-accessible installations of Homarus in certain configurations. The issue has been patched in...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via the X-Islandora-Args header. An attacker can execute arbitrary code on the server by sending a crafted request containing malicious inp...

GHSA-C2P2-HGJG-9R3F Crayfish Allows Remote Code Execution via hypercube X-Islandora-Args Header

Impact What kind of vulnerability is it? Who is impacted? Remote code execution is possible in web-accessible installations of hypercube. Patches Has the problem been patched? What versions should users upgrade to? Not yet, though no patch is neccessary if your installation of the microservices i...