2912 matches found
Malicious code in show-dependencies (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7ffc4fb420d4b6a7508fa65da3a3695af74f01732f92bf8a4beaac80d16c1985 The OpenSSF Package Analysis project identified 'show-dependencies' @...
MAL-2025-5591 Malicious code in show-dependencies (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7ffc4fb420d4b6a7508fa65da3a3695af74f01732f92bf8a4beaac80d16c1985 The OpenSSF Package Analysis project identified 'show-dependencies' @...
Understand your software’s supply chain with GitHub’s dependency graph
What if you could spot the weakest link in your software supply chain before it breaks? With GitHub's dependency graph, you can. By providing a clear, complete view of the external packages your code depends on, both directly and indirectly, it allows you to understand, secure, and manage your...
Malicious code in pkg-dev-deps-only (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 485d0ed1b5c95a60c68f04e0d03f68c9cb74cf2f0d2cc2181b99be5b1b8d7dc5 Any computer that has this package installed or running should be considered...
Security update for google-osconfig-agent
This update for google-osconfig-agent fixes the following issues: Update to version 20250416.02 bsc1244304, bsc1244503 defaultSleeper: tolerate 10% difference to reduce test flakiness Add output of some packagemanagers to the testdata from version 20250416.01 Refactor OS Info package from version...
Cves
It is an offensive tool for Windows. The repository appears to b...
Detecting Hard-Coded Credentials in Software Repositories Via LLMs
Software developers frequently hard-code credentials such as passwords, generic secrets, private keys, and generic tokens in software repositories, even though it is strictly advised against due to the severe threat to the security of the software. These credentials create attack surfaces...
SAVANT: Vulnerability Detection in Application Dependencies through Semantic-Guided Reachability Analysis
The integration of open-source third-party library dependencies in Java development introduces significant security risks when these libraries contain known vulnerabilities. Existing Software Composition Analysis SCA tools struggle to effectively detect vulnerable API usage from these libraries d...
[SECURITY] Fedora 42 Update: python-setuptools-74.1.3-7.fc42
Setuptools is a collection of enhancements to the Python distutils that allow you to more easily build and distribute Python packages, especially ones that have dependencies on other packages. This package also contains the runtime components of setuptools, necessary to execute the software that...
The vulnerability of the copy_page_from_iter_atomic() function in the lib/iov_iter.c module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the copypagefromiteratomic function in the lib/ioviter.c module of the Linux kernel is related to dependencies that are undefined for each implementation type. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibilit...
Exploit for Code Injection in Langflow
CVE-2025-3248 — Langflow AI Remote Code Execution Unauthentic...
CVE-2025-32800
CVE-2025-32800 affects the Conda-build tool. Before version 25.3.0, its pyproject.toml lists the dependency conda-index , which is not published in PyPI. An attacker could claim the namespace and upload arbitrary/malicious code, enabling exploitation during a pip install when resolving dependenci...
PyPI, npm, and AI Tools Exploited in Malware Surge Targeting DevOps and Cloud Environments
Cybersecurity researchers from SafeDep and Veracode detailed a number of malware-laced npm packages that are designed to execute remote code and download additional payloads. The packages in question are listed below - eslint-config-airbnb-compat 676 Downloads ts-runtime-compat-check 1,588...
Conda-build 安全漏洞
Conda-build is a Conda open source command and tool for building conda packages. A security vulnerability exists in Conda-build versions prior to 25.3.0, which stems from the listing of unreleased dependencies in pyproject.toml and could lead to malicious code injection...
TencentOS Server 4: rust (TSSA-2024:0635)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0635 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...
[SECURITY] Fedora 41 Update: python3.11-3.11.13-1.fc41
Python 3.11 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.11 package provides the "python3.11" executable:...
Fedora 42 : python-pydantic-core / rust-adblock / rust-cookie_store / etc (2025-04847cb65d)
The remote Fedora 42 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-04847cb65d advisory. Update uv to 0.6.14, with various bugfixes and new features. Update rust-idna to 1.0.3 fixing RUSTSEC-2024-0421, rust-url to 2.5.4, rust- adblock to 0.9.6, a...
Huawei EulerOS: Security Advisory for libxml2 (EulerOS-SA-2025-1670)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Security update for docker-compose
This update for docker-compose fixes the following issues: Update to version 2.33.1: Improvements Add support for gwpriority, enableipv4 requires docker v28.0 by @thaJeztah in 12570 Fixes Run watch standalone if menu fails to start by @ndeloof in 12536 Report error using non-file secret|config wi...
