CVE-2025-63603

A command injection vulnerability exists in the MCP Data Science Server (reading-plus-ai/mcp-server-data-exploration) version 0.1.6 . The flaw is located in the safe_eval() function (src/mcp_server_ds/server.py:108), which uses Python's exec() to run user-supplied scripts without restricting the ...

HSEC-2025-0006 Private key leak via inherited file descriptor

Private key leak via inherited file descriptor The X.509 key reading function readKeyFile opened a file descriptor to the private key without setting the close-on-exec flag. If a child process is execed at the same time, it would inherit that file descriptor and could read the private key materia...

PT-2025-55202

Private key leak via inherited file descriptor The X.509 key reading function readKeyFile opened a file descriptor to the private key without setting the close-on-exec flag. If a child process is execed at the same time, it would inherit that file descriptor and could read the private key materia...

The vulnerability of the exec() function in the interactive-git-checkout command-line utility allows a attacker to execute arbitrary commands.

The vulnerability of the exec function in the interactive-git-checkout command-line utility is related to insufficient input validation. Exploiting this vulnerability could allow a remote attacker to execute arbitrary commands...

SUSE CVE-2025-40166

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Check GuC running state before deregistering exec queue In normal operation, a registered exec queue is disabled and deregistered through the GuC, and freed only after the GuC confirms completion. However, if the driv...

CVE-2025-40166

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Check GuC running state before deregistering exec queue In normal operation, a registered exec queue is disabled and deregistered through the GuC, and freed only after the GuC confirms completion. However, if the driv...

Malicious code in izar-ora-exec-genomics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53d17c4563e99682e42e4eae296514441c01b6f64a6c19ecde3adc967d542d2e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-176166

Malicious code in subduction-exec-redis-gatsby npm...

EUVD-2025-177812

Malicious code in miranda-exec-meissa-terser npm...

EUVD-2025-178997

Malicious code in exec-antimatter-jovian-postgres npm...

EUVD-2025-178996

Malicious code in exec-dactyl-halley-phoebe npm...

EUVD-2025-178994

Malicious code in exec-markdown-avior-sirius npm...

EUVD-2025-178991

Malicious code in exec-radiometric-aether-juno npm...

EUVD-2025-178992

Malicious code in exec-proxima-ophiuchus-exec npm...

EUVD-2025-178988

Malicious code in exec-zephyr-xo-izar npm...

EUVD-2025-180235

Malicious code in aurora-exec-nebula-titan npm...

EUVD-2025-176280

Malicious code in spawn-exec-zenobia-ganymede npm...

EUVD-2025-178993

Malicious code in exec-mira-puppeteer-warp npm...

Malicious code in spawn-exec-zenobia-ganymede (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08d195fec77b588ee50726619249d1d77aacd06b4a03966370f3dee0c6edc02d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in aurora-exec-nebula-titan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 727d149233b8486494ce40ab83a3e2e4ecf442479f183b3b96baae8f80f59da2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...