EUVD-2025-112904

Malicious code in heka-mini-css-extract-plugin-xenos-prompts npm...

EUVD-2025-113102

Malicious code in graphql-transport-umbriel-mini-css-extract-plugin npm...

EUVD-2025-111122

Malicious code in mini-css-extract-plugin-release-it-antares-rollup npm...

EUVD-2025-111123

Malicious code in mini-css-extract-plugin-redis-tool-ignite npm...

EUVD-2025-114349

Malicious code in dotenv-safe-mini-css-extract-plugin-pm2-buffer npm...

EUVD-2025-111468

Malicious code in magellan-meissa-mini-css-extract-plugin-dorado npm...

EUVD-2025-113801

Malicious code in event-deimos-mini-css-extract-plugin-mira npm...

EUVD-2025-111833

Malicious code in leda-mini-css-extract-plugin-backend-radiant npm...

EUVD-2025-121593

Malicious code in style-loader-mini-css-extract-plugin-warp-perseus npm...

EUVD-2025-111132

Malicious code in mini-css-extract-plugin-npm-lint-lacerta npm...

MAL-2025-142595 Malicious code in fork-publish-node-config-mini-css-extract-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2f6e9a7562a333d4e73524c50d96a1a156c6d0d860a6af6a4cad3f0ea51e112 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147721 Malicious code in scorpius-vuetify-metalsmith-mini-css-extract-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2186526dff27c6c4fa856cfe4c9936a3d13ab0f924c3f55f611a9ca589374cf1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

ROS-20251106-04

Vulnerability of django.utils.archive.extract function of Django web application software platform is related to errors in the relative directory path handling mechanism. Exploitation of the vulnerability could allow a remote attacker to bypass security restrictions. Vulnerability in...

OPENSUSE-SU-2025:20022-1 Security update for python-Django

This update for python-Django fixes the following issues: - CVE-2025-59681: Fixed a potential SQL injection in QuerySet.annotate, alias, aggregate, and extra on MySQL and MariaDB boo1250485 - CVE-2025-59682: Fixed a potential partial directory-traversal via archive.extract boo1250487...

UBUNTU-CVE-2025-12060

The keras.utils.getfile API in Keras, when used with the extract=True option for tar archives, is vulnerable to a path traversal attack. The utility uses Python's tarfile.extractall function without the filter="data" feature. A remote attacker can craft a malicious tar archive containing special...

CVE-2025-12060

The keras.utils.getfile API in Keras, when used with the extract=True option for tar archives, is vulnerable to a path traversal attack. The utility uses Python's tarfile.extractall function without the filter="data" feature. A remote attacker can craft a malicious tar archive containing special...

CVE-2025-12060 Keras keras.utils.get_file Utility Path Traversal Vulnerability

The keras.utils.getfile API in Keras, when used with the extract=True option for tar archives, is vulnerable to a path traversal attack. The utility uses Python's tarfile.extractall function without the filter="data" feature. A remote attacker can craft a malicious tar archive containing special...

CVE-2025-54384

CKAN is an open-source DMS data management system for powering data hubs and data portals. Prior to 2.10.9 and 2.11.4, the helpers.markdownextract function did not perform sufficient sanitization of input data before wrapping in an HTML literal element. This helper is used to render user-provided...

PT-2025-44433

Name of the Vulnerable Software and Affected Versions Keras affected versions not specified Description The keras.utils.get file API in Keras is susceptible to a path traversal issue when the extract=True option is used with tar archives. The utility employs Python’s tarfile.extractall function...

FreeBSD : Erlang - Absolute Path in Zip Module (237f4f57-b50f-11f0-ae9b-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 237f4f57-b50f-11f0-ae9b-b42e991fc52e advisory. https://github.com/erlang/otp/security/advisories/GHSA-9g37-pgj9-wrhc reports: Improper Limitation of a...