EUVD-2025-37152

Malicious code in epic-env-utils npm...

MAL-2025-49141 Malicious code in epic-env-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f94098f216650c7955adfe4a82c23f4368b9cae20abff8da12aa162e4a8e8b4 The package epic-env-utils was found to contain malicious code...

Siemens SIMATIC Devices Improper Restriction of Operations within the Bounds of a Memory Buffer (CVE-2024-42292)

In the Linux kernel, the following vulnerability has been resolved: kobjectuevent: Fix OOB access within zapmodaliasenv zapmodaliasenv wrongly calculates size of memory block to move, so will cause OOB memory access issue if variable MODALIAS is not the last one within its @env parameter, fixed b...

Malicious code in env-app (npm)

The package env-app was found to contain malicious code...

MAL-2025-48680 Malicious code in env-app (npm)

The package env-app was found to contain malicious code...

Improper Input Validation

datahihi1/tiny-env is vulnerable to Improper Input Validation. The vulnerability is due to missing sanitization of characters, allowing attackers to inject comment text that can cause misconfigurations or authentication failures...

PT-2025-42375

Name of the Vulnerable Software and Affected Versions Reflex versions 0.5.4 through 0.8.14 Description Reflex is a library used to build full-stack web applications in Python. Versions 0.5.4 through 0.8.14 contain an issue in the /auth-codespace endpoint where the redirect to query parameter valu...

tracexec has `env` command argument injection via environment variables starting with dash in traced exec events

Impact For tracexec's command line reconstruction feature, when a traced process executes another process with a environment variable where the key starts with a dash, tracexec incorrectly shows its commandline where such environment variables could cause argument injection for the env command...

EUVD-2005-4143

Malware in sbrugna...

EUVD-2024-22149

Malicious code in bioql PyPI...

EUVD-2022-6579

Malicious code in bioql PyPI...

EUVD-2024-54605

Malicious code in bioql PyPI...

EUVD-2025-18593

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2025-9232

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'noproxy' environment variable is set and the...

cde (0.2.0.1), env-wrappers (>=0.1.1, <=0.1.22) +1 more potentially affected by CVE-2025-10952 via ml-logger (0.10.36)

ml-logger PYPI version 0.10.36 is affected by a known vulnerability. The following packages have a transitive dependency on ml-logger and may be impacted: - cde 0.2.0.1 - env-wrappers =0.1.1, =0.1.22 - graph-search 0.1.0 Source cves: CVE-2025-10952 Source advisory: SNYK:PYTHON-MLLOGGER-13110030...

cde (0.2.0.1), env-wrappers (>=0.1.1, <=0.1.22) +1 more potentially affected by CVE-2025-10950 via ml-logger (0.10.36)

ml-logger PYPI version 0.10.36 is affected by a known vulnerability. The following packages have a transitive dependency on ml-logger and may be impacted: - cde 0.2.0.1 - env-wrappers =0.1.1, =0.1.22 - graph-search 0.1.0 Source cves: CVE-2025-10950 Source advisory: SNYK:PYTHON-MLLOGGER-13110026...

CVE-2025-34206 Vasion Print (formerly PrinterLogic) Insecure Shared Storage Permissions

Vasion Print formerly PrinterLogic Virtual Appliance Host and Application VA and SaaS deployments mount host configuration and secret material under /var/www/efsstorage into many Docker containers with overly-permissive filesystem permissions. Files such as secrets.env, GPG-encrypted blobs in...

CVE-2025-59427

The Cloudflare Vite plugin enables a full-featured integration between Vite and the Workers runtime. When utilising the Cloudflare Vite plugin in its default configuration, all files are exposed by the local dev server, including files in the root directory that contain secret information such as...

Malware in @things-factory/env

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-47222 Malicious code in @things-factory/env (npm)

Suspicious postinstall script executing bundle.js and YARA rule match on bundle.js indicate potential malicious behavior. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 88b8463d9fb16ac5faed1cd122997c683cc79534786bcf816139cefc13897168 Any computer that has this...