1897 matches found
10by10-react-app (1.2.1), 192.168.0.172 (4.6.1) +13877 more potentially affected by CVE-2025-7339 via on-headers (>=1.0.0, <=1.0.2)
on-headers NPM version =1.0.0, =1.0.2, =1.0.0, =0.30.0, =0.2.0, =0.0.28, =4.11.0, =4.11.46 and more Source cves: CVE-2025-7339 Source advisory: OSV:GHSA-76C9-3JPH-RJ3Q...
@_lan/uni-libs (0.0.3), @acegroup/cli-templates-vue3-element-admin (1.0.0) +705 more potentially affected by CVE-2025-53892 via @intlify/core-base (>=9.0.0, <=9.14.4)
@intlify/core-base NPM version =9.0.0, =0.0.12, =0.0.1, =0.0.1, =0.0.1, =0.0.0-next.5436b378dff7e64898bb7046afa2d5d574255b54, =0.0.0-next.0d1cf82f9dfbe1d3e7ec5644f85f97a43c8c2334, =0.7.0-beta.15, =0.7.0-beta.15, =0.0.23, =0.0.6-alpha-2.5, =1.0.0, =0.1.87, =0.3.2 and more Source cves: CVE-2025-538...
aoer-plotty-rs (>=0.3.0, <=0.4.1), d3_delaunay_rs (>=0.10.0, <=0.11.2) +46 more potentially affected by unknown CVE via i_tree (>=0.2.0, <=0.9.0)
itree CARGO version =0.2.0, =0.3.0, =0.10.0, =0.10.5, =0.1.0, =0.29.0, =0.0.2, =0.2.0, =0.7.0, =0.1.0, =0.1.1 - geodatafusion 0.1.0-dev - geograph 0.2.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0165...
We Urgently Need Privilege Management in MCP: a Measurement of API Usage in MCP Ecosystems
The Model Context Protocol MCP has emerged as a widely adopted mechanism for connecting large language models to external tools and resources. While MCP promises seamless extensibility and rich integrations, it also introduces a substantially expanded attack surface: any plugin can inherit broad...
eth-utils (>=0.1.1, <=0.2.0), evm (>=0.17.3, <=0.36.0) +25 more potentially affected by CVE-2025-53359 via ethereum (>=0.4.2, <=0.12.0)
ethereum CARGO version =0.4.2, =0.1.1, =0.17.3, =1.0.0, =1.0.0, =1.0.0, =1.0.1 - ovr-evm-precompile-ed25519 2.0.0 - ovr-evm-precompile-modexp 2.0.0 - ovr-evm-precompile-sha3fips 2.0.0 - ovr-evm-test-vector-support 1.0.0 and more Source cves: CVE-2025-53359 Source advisory: OSV:GHSA-3W94-VQ2X-V5WR...
@devsoutinho/alfred-currency-converter (>=2.0.0, <=2.1.1), @felixcatto/ui (>=0.0.14, <=0.0.32) +13 more potentially affected by CVE-2025-45143 via string-math (1.2.2)
string-math NPM version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on string-math and may be impacted: - @devsoutinho/alfred-currency-converter =2.0.0, =0.0.14, =0.4.0-beta.2, =1.5.12, =0.1.47, =0.0.32, =2.0.0, =4.0.0, =1.0.0, =1.2.0, =1.0.8,...
GitHub Advisory Database by the numbers: Known security vulnerabilities and what you can do about them
The GitHub Advisory Database Advisory DB is a vital resource for developers, providing a comprehensive list of known security vulnerabilities and malware affecting open source packages. This post analyzes trends in the Advisory DB, highlighting the growth in reviewed advisories, ecosystem coverag...
Important: Red Hat Security Advisory: New RHCS 8.1 container image is now available in the Red Hat Ecosystem Catalog.
A new container image for Red Hat Ceph Storage 8.1 is now available in the Red Hat Ecosystem Catalog. Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a Ceph management platform, deployment utilities,...
CVE-2025-52488
DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted series of malicious interaction to potentially expose NTLM hashes to a third party SMB server. This issue has been...
Important: Red Hat Security Advisory: Updated 7.1 container image is now available in the Red Hat Ecosystem Catalog.
A new rhceph-7.1 container image is now available in the Red Hat Ecosystem Catalog. Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a Ceph management platform, deployment utilities, and support...
CVE-2025-52487 DNN.PLATFORM possibly allows bypass of IP Filters
DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. In versions 7.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted request or proxy to be created that could bypass the design of DNN Login IP Filters allowing login attempts from IP...
CVE-2025-52485 DNN.PLATFORM Allows Stored Cross-Site Scripting (XSS) in Activity Feed
DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted request to inject scripts in the Activity Feed Attachments endpoint which will then render in the feed. This issue...
MalGuard: Towards Real-Time, Accurate, and Actionable Detection of Malicious Packages in PyPI Ecosystem
Malicious package detection has become a critical task in ensuring the security and stability of the PyPI. Existing detection approaches have focused on advancing model selection, evolving from traditional machine learning ML models to large language models LLMs. However, as the complexity of the...
Qilin Ransomware Adds "Call Lawyer" Feature to Pressure Victims for Larger Ransoms
The threat actors behind the Qilin ransomware-as-a-service RaaS scheme are now offering legal counsel for affiliates to put more pressure on victims to pay up, as the cybercrime group intensifies its activity and tries to fill the void left by its rivals. The new feature takes the form of a "Call...
The New Frontline: Why DevOps Became a Cyber Target
Running short on time but still want to stay in the know? Well, we’ve got you covered! We’ve condensed all the key takeaways into a handy audio summary. Our AI-driven podcasts are fit for on the go. Click right here to hear it all on CAASM & CDMB Inefficiencies! Your developers didn't become...
@dm3-org/delivery-service (>=1.4.0, <=1.7.1), @dm3-org/dm3-backend (>=1.0.1, <=1.7.1) +18 more potentially affected by unknown CVE via @dm3-org/dm3-lib-crypto (1.7.2)
@dm3-org/dm3-lib-crypto NPM version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on @dm3-org/dm3-lib-crypto and may be impacted: - @dm3-org/delivery-service =1.4.0, =1.0.1, =1.0.5, =1.0.5, =1.0.5, =1.0.5, =1.0.5, =0.0.1-alpha1, =1.0.5, =1.4.0,...
[SECURITY] Fedora 42 Update: qt6-qtshadertools-6.9.1-1.fc42
Qt6 - Qt Shader Tools module builds on the SPIR-V Open Source Ecosystem...
Data-Driven Understanding of Security Issue Reporting in GitHub Repositories of Open Source Npm Packages
The npm Node Package Manager ecosystem is the most important package manager for JavaScript development with millions of users. Consequently, a plethora of earlier work investigated how vulnerability reporting, patch propagation, and in general detection as well as resolution of security issues i...
net.aequologica.neo:geppaequo-tags (>=0.5.3, <=0.6.0), net.aequologica.neo:geppaequo-web (>=0.5.3, <=0.6.0) +4 more potentially affected by CVE-2025-2336 via org.webjars.npm:angular-sanitize (>=1.5.0-beta.0, <=1.8.3)
org.webjars.npm:angular-sanitize MAVEN version =1.5.0-beta.0, =0.5.3, =0.5.3, =0.6.0 - org.webjars.npm:angular-auto-complete 1.7.4 - org.webjars.npm:angular-material-calendar 0.2.14 - org.webjars.npm:angular-schema-form 0.8.13 - org.webjars.npm:github-com-showdownjs-ng-showdown 1.1.0 Source cves:...
