EUVD-2025-115546

Malicious code in ceres-dependencies-restart-prompts npm...

EUVD-2025-116487

Malicious code in astro-postgres-dependencies-bellatrix npm...

Malicious code in guilty_ape_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 043177cf992ec44d41a3f6493eebddb9ab8f003042a9bb1381d0df595817ca1e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-98690 Malicious code in dutch_galliform_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 564c4c3d07d463ddb5695115f239373adfe2bf351e7d637a57bddbd898459bb2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dian-getas47-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94e86717a95348296454ce31bdb777604510ddf30616949757eab69ca74c93a4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ember-addon-with-dependencies (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 030efb54b3c7ce3807868d73f64d415effba5c936da7b4fad9b37a7e184fbff7 The package ember-addon-with-dependencies was found to contain malicious code. Source: ossf-package-analysis...

MAL-2025-76661 Malicious code in ember-addon-with-dependencies (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 030efb54b3c7ce3807868d73f64d415effba5c936da7b4fad9b37a7e184fbff7 The package ember-addon-with-dependencies was found to contain malicious code. Source: ossf-package-analysis...

MAL-2025-70735 Malicious code in soviet-copper-sawfish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c610ef07f4b6e47a15a61fd1b1bb6e66da27eda0864d5520b02f8c7179035c3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Prototype Pollution

magix-combine-ex is vulnerable to Prototype Pollution. The vulnerability is due to improper input validation in the util-deps.addFileDepend function, which allows an attacker to inject malicious properties into Object.prototype, leading to denial of service DoS or other unexpected behavior...

[SECURITY] Fedora 43 Update: uv-0.9.7-2.fc43

An extremely fast Python package installer and resolver, written in Rust. Designed as a drop-in replacement for common pip and pip-tools workflows. Highlights: =E2=80=A2 =E2=9A=96=EF=B8=8F Drop-in replacement for common pip, pip-tools, and virtualenv commands. =E2=80=A2 =E2=9A=A1=EF=B8=8F 10-100x...

Fedora 42 : bpfman (2025-0753bddd6c)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-0753bddd6c advisory. This update fixes CVE-2025-0977 RUSTSEC-2025-0004, a use-after-free vulnerability in the Rust openssl crate's ssl::selectnextproto function. The openssl crat...

Fedora 43 : bpfman (2025-e67231423f)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-e67231423f advisory. This update fixes CVE-2025-0977 RUSTSEC-2025-0004, a use-after-free vulnerability in the Rust openssl crate's ssl::selectnextproto function. The openssl crat...

[SECURITY] Fedora 41 Update: libnbd-1.22.5-1.fc41

NBD =E2=80=94 Network Block Device =E2=80=94 is a protocol for accessing Bloc k Devices hard disks and disk-like things over a Network. This is the NBD client library in userspace, a simple library for writing NBD clients. The key features are: Synchronous and asynchronous APIs, both for ease of...

[SECURITY] Fedora 42 Update: libnbd-1.22.5-1.fc42

NBD =E2=80=94 Network Block Device =E2=80=94 is a protocol for accessing Bloc k Devices hard disks and disk-like things over a Network. This is the NBD client library in userspace, a simple library for writing NBD clients. The key features are: Synchronous and asynchronous APIs, both for ease of...

[SECURITY] Fedora 42 Update: qt5-qtwebsockets-5.15.18-1.fc42

The QtWebSockets module implements the WebSocket protocol as specified in RFC 6455. It solely depends on Qt no external dependencies...

[SECURITY] Fedora 43 Update: uv-0.9.5-1.fc43

An extremely fast Python package installer and resolver, written in Rust. Designed as a drop-in replacement for common pip and pip-tools workflows. Highlights: =E2=80=A2 =E2=9A=96=EF=B8=8F Drop-in replacement for common pip, pip-tools, and virtualenv commands. =E2=80=A2 =E2=9A=A1=EF=B8=8F 10-100x...

Fedora 42 : openapi-python-client (2025-16b2da653e)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-16b2da653e advisory. - add patch to remove dependency upper bound versions - remove obsolete patches that updated upper bound versions - clean up spec file formatting Tenable has...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989828)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989828 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/sched: Avoid data corruptions Wait for all dependencies of a job to complete before killing i...

EUVD-2025-37739

Malicious code in pkg-with-optional npm...

Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which are vulnerable to CVEs.

Summary IBM Maximo Application Suite uses "form-data 4.0.0, org.apache.cxfcxf-core 3.6.7 , net/http/internal v1.24.1, braces 3.0.2 , cross-spawn 7.0.3 , crypto/x509 1.24.1 1.24.3 , github.com/golang-jwt/jwt/v4 github.com/golang-jwt/jwt/v5 v4.5.0 v5.2.1 , httpd 2.4.37 , setuptools 78.0.2 75.8.0 ,...