Alibaba Cloud Linux 3 : 0151: resource-agents (ALINUX3-SA-2025:0151)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2025:0151 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2024-47081: Requests is a HTTP library. Due to ...

CVE-2025-58373

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a vulnerability where .rooignore protections could be bypassed using symlinks. This allows an attacker with write access to the workspace to trick the extension into reading files th...

CVE-2025-58373

Roo Code (editor-integrated AI coding agent) versions 3.25.23 and earlier contain a symlink-based bypass of the .rooignore protections. An attacker with write access to the workspace could trick the extension into reading files that should be excluded (for example, .env or other configuration dat...

Malicious code in convict-fomalhaut-morgan-cross-env (npm)

The package convict-fomalhaut-morgan-cross-env was found to contain malicious code...

Malicious code in cross-env-html-webpack-plugin-writable-dactyl (npm)

The package cross-env-html-webpack-plugin-writable-dactyl was found to contain malicious code...

Malicious code in elektra-cross-env-deimos-ganymede (npm)

The package elektra-cross-env-deimos-ganymede was found to contain malicious code...

Malicious code in zephyr-electron-builder-cross-env-cressida (npm)

The package zephyr-electron-builder-cross-env-cressida was found to contain malicious code...

Malicious code in algol-cross-env-biomimicry-semantic-ui (npm)

The package algol-cross-env-biomimicry-semantic-ui was found to contain malicious code...

MAL-2025-43430 Malicious code in algol-cross-env-biomimicry-semantic-ui (npm)

The package algol-cross-env-biomimicry-semantic-ui was found to contain malicious code...

MAL-2025-43889 Malicious code in convict-fomalhaut-morgan-cross-env (npm)

The package convict-fomalhaut-morgan-cross-env was found to contain malicious code...

MAL-2025-43910 Malicious code in cross-env-html-webpack-plugin-writable-dactyl (npm)

The package cross-env-html-webpack-plugin-writable-dactyl was found to contain malicious code...

MAL-2025-44124 Malicious code in elektra-cross-env-deimos-ganymede (npm)

The package elektra-cross-env-deimos-ganymede was found to contain malicious code...

MAL-2025-43911 Malicious code in cross-env-proteomics-superposition-geomorphology (npm)

The package cross-env-proteomics-superposition-geomorphology was found to contain malicious code...

Security Bulletin: IBM Cognos Dashboards on Cloud Pak for Data has addressed security vulnerabilities.

Summary There are vulnerabilities in IBM® Semeru Runtime and Open-Source Software OSS components consumed by IBM Cognos Dashboards on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2025-25193 DESCRIPTION: Netty, an asynchronous, event-driven network application framework, has a vulnerability...

Malicious code in import-license-checker (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c41ca4c8119fa20f7f5915b34de59f879b77fedf237cbbf5a69e46ddbeded428 Package exfiltrates content of .env files to a remote target --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Linux Distros Unpatched Vulnerability : CVE-2019-16228

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in py-lmdb 0.97. There is a divide-by-zero error in the function mdbenvopen2 if mdbenvreadheader obtains a zero value for a certain size...

Remote Code Execution (RCE)

Overview picklescan is a Security scanner detecting Python Pickle files performing suspicious actions Affected versions of this package are vulnerable to Remote Code Execution RCE due to the use of torch.utils.collectenv.run in the reduce method. An attacker can execute arbitrary code by crafting...

PT-2026-54006

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 0.0.28 Description The software fails to detect malicious pickle files that utilize the torch.utils.collect env.run function within reduce methods. This allows attackers to embed hidden code in pickle files, which...

MAL-2025-41355 Malicious code in @navify-platform/env (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

CVE-2025-57754 eslint-ban-moment exposed a sensitive Supabase URI in .env (Credential leak)

eslint-ban-moment is an Eslint plugin for final assignment in VIHU. In 3.0.0 and earlier, a sensitive Supabase URI is exposed in .env. A valid Supabase URI with embedded username and password will allow an attacker complete unauthorized access and control over database and user data. This could...