PT-2026-6420

Impact The deriveVaultKey function calls retrieveCloudKey which always returns "foobarfoobarfoobarfoobarfoobarfo". When merged with the randomly generated 32-byte key using mergeKeys 16 bytes from each, the last 16 bytes are always "arfoobarfoobarfo". This enables an attacker with physical access...

Multiple Vulnerabilities in Node.js (Wednesday, May 14, 2025 Security Releases). Nessus Plugin ID 236766

In Node.js, the ReadFileUtf8 internal binding leaks memory due to a corrupted pointer in uvfss.file: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory...

[SECURITY] Fedora 42 Update: rust-rkyv_derive0.7-0.7.46-1.fc42

Derive macro for rkyv...

[SECURITY] Fedora 43 Update: rust-rkyv_derive0.7-0.7.46-1.fc43

Derive macro for rkyv...

Fedora 43 : rust-rkyv0.7 / rust-rkyv_derive0.7 (2026-35d1dee2ab)

The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-35d1dee2ab advisory. https://rustsec.org/advisories/RUSTSEC-2026-0001 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

Fedora 44 : rust-rkyv0.7 / rust-rkyv_derive0.7 (2026-f08ea66b23)

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-f08ea66b23 advisory. https://rustsec.org/advisories/RUSTSEC-2026-0001 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

EUVD-2024-55350

Dormakaba Saflok System 6000 contains a predictable key generation algorithm that allows attackers to derive card access keys from a 32-bit unique identifier. Attackers can exploit the deterministic key generation process by calculating valid access keys using a simple mathematical transformation...

CVE-2024-58311 Dormakaba Saflok System 6000 Key Generation Cryptographic Weakness

Dormakaba Saflok System 6000 contains a predictable key generation algorithm that allows attackers to derive card access keys from a 32-bit unique identifier. Attackers can exploit the deterministic key generation process by calculating valid access keys using a simple mathematical transformation...

PT-2025-50973

Name of the Vulnerable Software and Affected Versions Dormakaba Saflok System 6000 affected versions not specified Description The Dormakaba Saflok System 6000 uses a key generation algorithm that is predictable. This allows attackers to calculate card access keys from a 32-bit unique identifier...

TencentOS Server 4: nodejs20 (TSSA-2025:0415)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0415 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

[SECURITY] Fedora 41 Update: rust-get-size-derive2-0.7.1-1.fc41

Derives the GetSize trait...

[SECURITY] Fedora 42 Update: rust-get-size-derive2-0.7.1-1.fc42

Derives the GetSize trait...

Fedora 42 : python-uv-build / ruff / rust-get-size-derive2 / rust-get-size2 / etc (2025-e60a4ba4d7)

The remote Fedora 42 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-e60a4ba4d7 advisory. uv / python-uv-build 0.9.7 https://github.com/astral-sh/uv/releases/tag/0.9.7 0.9.6 This release contains an upgrade to Astral's fork of asynczip, which...

MAL-2025-187096 Malicious code in gammarayburst-quasarjet-radiometric-lyra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cacef3e59b76a6802cdb5a0e99fd3ba2fc957f0dfecb68349f709e0d0256ce91 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ananda-poke15 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ed858b064cecaba317074d11882b1b22a7a9612ac5f64b094056db593af10f8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tanur-sa-dafa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b871f0078a96c58ba1448967d257c97a2d2869066bbaee88ea0e2a333ee5f943 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-174239 Malicious code in goditu-tufabm-dibat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e980c8dc7a879ef7feb007e1f498fe8d2edc90d11ff69aa62dd13e2163f9773b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-175821 Malicious code in kupaio-ulokia-jakaloakaoi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 985e949f0a7bc8c17ddb999b238278036e32d7237b987b4d39534223f9b9ed70 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in aciyuudua-iadut-daina (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a9a09805ef39f03178fe09b5cc6c1c543498bca0d10c5e2d3edb5ee21b95118 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-159765 Malicious code in mansila-iala-maonldzdodadgfuai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c93931b9696a01b1ee6d0f5bbdf72e43517c03a05740b4394ac740dc1353c72 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...