02.aula (1.0.0), 19json-validator (>=0.0.3, <=0.0.4) +6610 more potentially affected by CVE-2024-55565 via nanoid (>=3.0.0, <=3.3.7)

nanoid NPM version =3.0.0, =0.0.3, =0.0.1, =0.1.23, =0.1.4, =0.1.3, =1.0.0, =0.0.1-alpha.9, =0.0.74, =0.0.14, =0.18.0-beta.0, =0.0.25, =0.0.1-alpha.89, =0.0.39 and more Source cves: CVE-2024-55565 Source advisory: OSV:GHSA-MWCW-C2X4-8C55...

boltchat (>=0.2.0, <=0.2.2), cargo-generate-rpm (>=0.10.0, <=0.11.0) +17 more potentially affected by CVE-2024-53857 via pgp (>=0.7.2, <=0.9.0)

pgp CARGO version =0.7.2, =0.2.0, =0.10.0, =0.8.0, =0.2.0, =0.1.0, =0.1.0, =0.19.0, =0.9.0-alpha.1, =0.0.1, =0.7.0, =0.8.1 - rpm-rs-temporary 0.6.1 - rpmrepometadata 0.2.0 and more Source cves: CVE-2024-53857 Source advisory: OSV:GHSA-4GRW-M28R-Q285...

CVE-2024-53863

Synapse is an open-source Matrix homeserver. In Synapse versions before 1.120.1, enabling the dynamicthumbnails option or processing a specially crafted request could trigger the decoding and thumbnail generation of uncommon image formats, potentially invoking external tools like Ghostscript for...

@alfaris/scratch-vm (1.0.0), @antv/g6 (>=5.0.0-beta.33, <=5.0.44) +83 more potentially affected by unknown CVE via hull.js (>=0.2.10, <=1.0.6)

hull.js NPM version =0.2.10, =5.0.0-beta.33, =5.1.12, =1.8.20, =1.0.2, =0.1.0, =0.0.1739797164641, =1.3.0, =0.1.0, =0.5.7, =1.0.0, =0.1.0-raspberrypifoundation.20210805151219, =1.0.0, =1.1.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-Q849-WXRC-VQRP...

Why Spring AI: The Seamless Path to Generative AI

Why Spring AI: The Seamless Path for Spring Developers to the World of Generative AI Intro As a Java developer exploring the world of generative AI, you’re probably aware of several frameworks that promise to make AI integration easy. I believe Spring AI stands out as the natural choice, especial...

cryptoballot (>=0.2.0, <=0.3.1), secret-sharing-cli (>=0.1.0, <=0.1.2) +1 more potentially affected by unknown CVE via sharks (>=0.3.3, <=0.4.3)

sharks CARGO version =0.3.3, =0.2.0, =0.1.0, =0.1.0, =0.1.2 Source cves: unknown CVE Source advisory: OSV:GHSA-JP37-5QHW-MFFW...

Fedora 37 : golang-github-facebookincubator-contest / etc (2022-53fdd2d9c4)

The remote Fedora 37 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2022-53fdd2d9c4 advisory. Rebuild for CVE-2022-24675,28327,29526 in golang and other go ecosystem CVEs These packages were missed in the initial rawhide go ecosystem rebuild a couple...

Wrap Up the Year with the Biggest Scope and Rewards Yet: Join the Wordfence Bug Bounty Program End of Year Holiday Extravaganza!

The holidays are here, and so is your chance to earn big while helping secure the WordPress ecosystem! For all submissions to our Bug Bounty Program from November 12, 2024, to December 9, 2024 , we’re rolling out our End of Year Holiday Extravaganza promotion to give back to our security...

Malicious NPM Packages Target Roblox Users with Data-Stealing Malware

A new campaign has targeted the npm package repository with malicious JavaScript libraries that are designed to infect Roblox users with open-source stealer malware such as Skuld and Blank-Grabber. "This incident highlights the alarming ease with which threat actors can launch supply chain attack...

@casablanca-css/core (0.2.0), @nuxtjs/device (>=3.2.0, <=3.2.2) +4 more potentially affected by CVE-2024-51757 via happy-dom (>=15.0.0, <=15.7.4)

happy-dom NPM version =15.0.0, =3.2.0, =6.0.1, =4.1.4, =5.1.4, =1.1.78, =1.1.79 Source cves: CVE-2024-51757 Source advisory: OSV:GHSA-96G7-G7G9-JXW8...

Malware Campaign Uses Ethereum Smart Contracts to Control npm Typosquat Packages

An ongoing campaign is targeting npm developers with hundreds of typosquat versions of their legitimate counterparts in an attempt to trick them into running cross-platform malware. The attack is notable for utilizing Ethereum smart contracts for command-and-control C2 server address distribution...

Inside the Massive Crime Industry That’s Hacking Billion-Dollar Companies

When you download a piece of pirated software, you might also be getting a piece of infostealer malware, and entering a highly complex hacking ecosystem that’s fueling some of the biggest breaches on the planet...

10minions-engine (>=0.0.1, <=0.0.4), @0xd541ecb3/byte-babe (>=1.0.0, <=1.2.1) +509 more potentially affected by CVE-2024-7774 via langchain (>=0.0.11, <=0.2.10)

langchain NPM version =0.0.11, =0.0.1, =1.0.0, =0.1.4, =0.0.11, =0.0.0, =0.0.2-alpha, =0.0.33-alpha2, =3.114.0, =1.0.0, =0.1.0, =2.0.68, =0.0.2, =0.1.0, =0.1.4 - @builderbot-plugins/free-gpt 0.0.6-alpha.0 and more Source cves: CVE-2024-7774 Source advisory: OSV:GHSA-HC5W-C9F8-9CC4...

[SECURITY] Fedora 41 Update: rust-pyo3-build-config-0.22.4-1.fc41

Build configuration for the PyO3 ecosystem...

[SECURITY] Fedora 41 Update: rust-pyo3-ffi-0.22.4-1.fc41

Python-API bindings for the PyO3 ecosystem...

b4ae (>=2.0.0, <=2.1.3), clatter (>=0.1.2-alpha, <=2.0.0-rc.1) +28 more potentially affected by unknown CVE via pqcrypto-kyber (>=0.1.2, <=0.8.1)

pqcrypto-kyber CARGO version =0.1.2, =2.0.0, =0.1.2-alpha, =0.1.4, =0.1.1, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.5.0 - qudag-exchange 0.2.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0381...

[SECURITY] Fedora 40 Update: rust-pyo3-build-config-0.22.4-1.fc40

Build configuration for the PyO3 ecosystem...

[SECURITY] Fedora 40 Update: rust-pyo3-ffi-0.22.4-1.fc40

Python-API bindings for the PyO3 ecosystem...

[SECURITY] Fedora 39 Update: rust-pyo3-build-config-0.22.4-1.fc39

Build configuration for the PyO3 ecosystem...

@0xgg/echomd (>=1.0.0, <=1.0.4), @7nohe/vite-plugin-vue-marked (0.2.1) +1057 more potentially affected by CVE-2024-47875 via dompurify (>=2.0.0, <=2.4.9)

dompurify NPM version =2.0.0, =1.0.0, =0.2.0-beta.9, =0.2.0-beta.13, =6.2.3, =6.4.3, =0.0.2-next.4, =0.3.0, =0.1.0, =0.1.0-a0, =1.0.0, =0.4.0, =0.0.18, =0.0.32 and more Source cves: CVE-2024-47875 Source advisory: OSV:GHSA-GX9M-WHJM-85JF...