MAL-2025-141070 Malicious code in convict-cross-env-fornax-buffer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3400ee48bb8e6820f883a6fbadd1dc8b8b946d5fc20c19fd0b0702614d2df39b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141276 Malicious code in cross-env-yakutsk-octans-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ec258cbc55d95a4aa0c35968e62956f226510e7535d823debd9ec5c976ed91e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-120628

Malicious code in wasat-sadr-iota-cross-env npm...

Security update for aws-efs-utils

This update for aws-efs-utils fixes the following issues: Update to version 2.3.3 bsc1240044. Security issues fixed: CVE-2025-55159: slab: incorrect bounds check in getdisjointmut function can lead to potential crash due to out-of-bounds access bsc1248055. CVE-2020-35881: traitobject: log4rs:...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: redka, gotestsum, pvc-autoresizer, checksec, timescaledb-parallel-copy, xcaddy, protoc-gen-go-grpc, kube-logging-operator-custom-runner, spicedb-operator, glow, xcover, runc, terraform-provider-azuread, stern, secrets-store-csi-driver, atlantis, nri-prometheus,...

CVE-2025-61723 vulnerabilities

Vulnerabilities for packages: redka, gotestsum, pvc-autoresizer, checksec, timescaledb-parallel-copy, xcaddy, protoc-gen-go-grpc, kube-logging-operator-custom-runner, spicedb-operator, glow, xcover, mkcert, runc, terraform-provider-azuread, stern, secrets-store-csi-driver, atlantis, nri-prometheu...

CVE-2025-47912 vulnerabilities

Vulnerabilities for packages: redka, gotestsum, pvc-autoresizer, checksec, timescaledb-parallel-copy, xcaddy, kube-logging-operator-custom-runner, spicedb-operator, glow, xcover, mkcert, runc, terraform-provider-azuread, stern, secrets-store-csi-driver, atlantis, nri-prometheus, thanos-operator,...

GHSA-RJCG-56PH-3QVG vulnerabilities

Vulnerabilities for packages: redka, gotestsum, pvc-autoresizer, checksec, timescaledb-parallel-copy, xcaddy, protoc-gen-go-grpc, kube-logging-operator-custom-runner, spicedb-operator, glow, xcover, mkcert, runc, terraform-provider-azuread, stern, secrets-store-csi-driver, atlantis, nri-prometheu...

GHSA-QH38-484V-W52X vulnerabilities

Vulnerabilities for packages: redka, gotestsum, pvc-autoresizer, checksec, timescaledb-parallel-copy, xcaddy, protoc-gen-go-grpc, kube-logging-operator-custom-runner, spicedb-operator, glow, xcover, mkcert, runc, terraform-provider-azuread, stern, secrets-store-csi-driver, atlantis, nri-prometheu...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: redka, gotestsum, pvc-autoresizer, checksec, timescaledb-parallel-copy, xcaddy, protoc-gen-go-grpc, kube-logging-operator-custom-runner, spicedb-operator, glow, xcover, mkcert, runc, terraform-provider-azuread, stern, secrets-store-csi-driver, atlantis, nri-prometheu...

GHSA-447V-2QG4-H8HC vulnerabilities

Vulnerabilities for packages: redka, gotestsum, pvc-autoresizer, checksec, timescaledb-parallel-copy, xcaddy, kube-logging-operator-custom-runner, spicedb-operator, glow, xcover, mkcert, runc, terraform-provider-azuread, stern, secrets-store-csi-driver, atlantis, nri-prometheus, thanos-operator,...

CVE-2025-58189 vulnerabilities

Vulnerabilities for packages: node-problem-detector, aws-iam-authenticator-fips, istio, kubernetes-csi-external-health-monitor, mc-fips, vault-secrets-operator, helm-mapkubeapis, external-dns, age, mesosphere-vsphere-csi, modelmesh-runtime-adapter, render-template, boring-registry-fips,...

Malicious code in epic-env-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f94098f216650c7955adfe4a82c23f4368b9cae20abff8da12aa162e4a8e8b4 The package epic-env-utils was found to contain malicious code...

EUVD-2025-37152

Malicious code in epic-env-utils npm...

MAL-2025-49141 Malicious code in epic-env-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f94098f216650c7955adfe4a82c23f4368b9cae20abff8da12aa162e4a8e8b4 The package epic-env-utils was found to contain malicious code...

Siemens SIMATIC Devices Improper Restriction of Operations within the Bounds of a Memory Buffer (CVE-2024-42292)

In the Linux kernel, the following vulnerability has been resolved: kobjectuevent: Fix OOB access within zapmodaliasenv zapmodaliasenv wrongly calculates size of memory block to move, so will cause OOB memory access issue if variable MODALIAS is not the last one within its @env parameter, fixed b...

Malicious code in env-app (npm)

The package env-app was found to contain malicious code...

MAL-2025-48680 Malicious code in env-app (npm)

The package env-app was found to contain malicious code...

Improper Input Validation

datahihi1/tiny-env is vulnerable to Improper Input Validation. The vulnerability is due to missing sanitization of characters, allowing attackers to inject comment text that can cause misconfigurations or authentication failures...

tracexec has `env` command argument injection via environment variables starting with dash in traced exec events

Impact For tracexec's command line reconstruction feature, when a traced process executes another process with a environment variable where the key starts with a dash, tracexec incorrectly shows its commandline where such environment variables could cause argument injection for the env command...