EUVD-2025-116453

Malicious code in atlas-mini-css-extract-plugin-equinox-stream npm...

EUVD-2025-116403

Malicious code in aurora-fomalhaut-ultra-mini-css-extract-plugin npm...

EUVD-2025-116230

Malicious code in babel-rehype-mini-css-extract-plugin-aether npm...

EUVD-2025-116846

Malicious code in airbnb-janus-uninstall-mini-css-extract-plugin npm...

EUVD-2025-111125

Malicious code in mini-css-extract-plugin-proxima-forever-altair npm...

EUVD-2025-122872

Malicious code in react-bootstrap-achernar-procyon-mini-css-extract-plugin npm...

MAL-2025-143208 Malicious code in heka-mini-css-extract-plugin-xenos-prompts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b17a7f1db0e8cf65d171b6b053a9b54a88580fcb443ea927debda2adbfaa55a2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-113102

Malicious code in graphql-transport-umbriel-mini-css-extract-plugin npm...

EUVD-2025-115932

Malicious code in buffer-soap-vortex-mini-css-extract-plugin npm...

EUVD-2025-121920

Malicious code in slidev-html-webpack-plugin-mini-css-extract-plugin-markdown npm...

EUVD-2025-120593

Malicious code in webdriver-manager-titan-mini-css-extract-plugin-izar npm...

EUVD-2025-111117

Malicious code in mini-css-extract-plugin-update-cassini-blaze npm...

Malicious code in atlas-mini-css-extract-plugin-equinox-stream (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 404eaf3881cfa0b5b7b50fc02a65725729afb42926f6345a7dedfe0f35627d70 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140484 Malicious code in castor-fetch-webdriver-manager-mini-css-extract-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51232fa12f2d0aa1acb5f8f227042e036d7eab4c9faf1918109f2c1b887da57f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144997 Malicious code in mini-css-extract-plugin-taurus-kastra-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa0ba0fec30c09bfc4ffa84020c6073f6557695591ee4f30f607a8ab23ac89c1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

ROS-20251106-04

Vulnerability of django.utils.archive.extract function of Django web application software platform is related to errors in the relative directory path handling mechanism. Exploitation of the vulnerability could allow a remote attacker to bypass security restrictions. Vulnerability in...

OPENSUSE-SU-2025:20022-1 Security update for python-Django

This update for python-Django fixes the following issues: - CVE-2025-59681: Fixed a potential SQL injection in QuerySet.annotate, alias, aggregate, and extra on MySQL and MariaDB boo1250485 - CVE-2025-59682: Fixed a potential partial directory-traversal via archive.extract boo1250487...

UBUNTU-CVE-2025-12060

The keras.utils.getfile API in Keras, when used with the extract=True option for tar archives, is vulnerable to a path traversal attack. The utility uses Python's tarfile.extractall function without the filter="data" feature. A remote attacker can craft a malicious tar archive containing special...

CVE-2025-12060

Removed by vendor...

CVE-2025-12060 Keras keras.utils.get_file Utility Path Traversal Vulnerability

The keras.utils.getfile API in Keras, when used with the extract=True option for tar archives, is vulnerable to a path traversal attack. The utility uses Python's tarfile.extractall function without the filter="data" feature. A remote attacker can craft a malicious tar archive containing special...