CVE-2025-71405

The CVE-2025-71405 entry concerns the chi library prior to v5.2.2. The vulnerability lies in the RedirectSlashes middleware, which uses the Host header to build redirect URLs. An attacker can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing and credential theft. ...

EUVD-2025-210728

chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft...

CVE-2025-71405 go-chi chi before v5.2.2 Open Redirect via RedirectSlashes

chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft...

CVE-2025-71405

chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft...

Malicious code in @veertly/web-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 356a8a00db1082e33357c6fa0bd625070977f72964236e992e1be94dcd419764 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @vyzensockets/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 65a38578ec3825683bc7646595c0676583ebf4bb3b5c36b5b92c5c7f4537e653 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in npm_pkg_1093 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fbcfd38e8ac9c31e28e53af79f450b1bf48ee623593d4dfd77388c945f802653 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in elf-stats-caroling-stocking-510 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2cf95a37aa32ab86e8c0039afad9eeb640550fd14146fdf94e39b08c33b4769c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in thepackagethatworks_ (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f15296c09e590124cd0c48b05fe2a07d3a2c798fe5ffe5bbc01fa91e1eeb18c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14082 Malicious code in google-logging-utils-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 60ff4b97c24301c3b850c5c7f2c1a6dfc07c695c2b19c879cc766373f1c2ded2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mw-filesystem-events-nodream-es6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04e79317db717bd6c38646bef40f0e5205e0f42a3174319f95d9b5e7153cc8fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nolimitcity (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fdd2f231bad56627ee2a46c05b99f33c745f97daaf7e05adbfbfcea535d7f530 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GO-2020-0017 vulnerabilities

Vulnerabilities for packages: docker-credential-acr-env, gitness, dgraph, docker-credential-acr-env-fips...

GO-2025-4013 vulnerabilities

Vulnerabilities for packages: dagdotdev, kepler, spire-controller-manager-fips, docker-credential-acr-env, local-path-provisioner-fips, conftest, prometheus-podman-exporter, render-template, tfsec, kubernetes-csi-livenessprobe-fips, dask-gateway, cyberark-secrets-provider-for-k8s-fips, dbmate,...

GO-2025-4009 vulnerabilities

Vulnerabilities for packages: dagdotdev, kepler, spire-controller-manager-fips, docker-credential-acr-env, local-path-provisioner-fips, conftest, prometheus-podman-exporter, render-template, tfsec, kubernetes-csi-livenessprobe-fips, dask-gateway, cyberark-secrets-provider-for-k8s-fips, dbmate,...

GO-2026-4807 vulnerabilities

Vulnerabilities for packages: hydra...

GO-2026-5602 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

GO-2020-0017 vulnerabilities

Vulnerabilities for packages: dgraph, gitness, docker-credential-acr-env...

GO-2025-4188 vulnerabilities

Vulnerabilities for packages: kubeflow, neuvector-dbgen, hello-world-golang, kpt, newrelic-nri-statsd, smokescreen, aws-flb-firehose, sonobuoy, src-fingerprint, aws-flb-cloudwatch, gostatsd, kube-fluentd-operator, php-fpmexporter, aws-flb-kinesis, terraform-provider-google, go-discover,...

GO-2025-4013 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-node-driver-registrar, direnv, ferretdb, hello-world-golang, istio, kubeflow, rancher-helm, rancher-telemetry, skopeo, spiffe-helper, custom-pod-autoscaler, dbmate, grpcurl, kubescape-operator, atlantis, crane, govulncheck, protoc-gen-go-grpc, bazelisk...