MAL-2025-47014 Malicious code in braintree-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 053257b915c2f0af69829fe05f32c4248f8dd415cf1a12103f297d5fbfe0574e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in rushstack-lockfile-explorer

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in image_classification

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @magda/semantic-indexer-sdk

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2025-54084

OS Command 'OS Command Injection' vulnerability in Calix GigaCenter ONT Quantenna SoC modules allows authenticated attackers with 'super' user credentials to execute arbitrary OS commands through improper input validation, potentially leading to full system compromise.This issue affects GigaCente...

Duplicate Advisory: Malware in prebid.js

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-jwq7-6j4r-2f92. This link is maintained to preserve external references. Original Description Any computer that has this package installed or running should be considered fully compromised. All secrets and keys...

Malicious code in @oneaudi/unified-web-common (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 20171e9f2ae7e55f3032123ab947e0b9f8cbccfb379a0eab62a30efd737da76b Any computer that has this package installed or running should be considered...

MAL-2025-47043 Malicious code in @oneaudi/unified-web-common (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 20171e9f2ae7e55f3032123ab947e0b9f8cbccfb379a0eab62a30efd737da76b Any computer that has this package installed or running should be considered...

Malicious code in ome-api (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 813109d74c2326a2f6ec2d8189b807fcde2654e778172aef8555defeb27fc4a8 Any computer that has this package installed or running should be considered...

Malicious code in tianqishengqishi (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ddecffb254d25ae1045c69e679f0d81b5b6e4489bb06874481ee686038135178 Any computer that has this package installed or running should be considered...

MAL-2025-47090 Malicious code in tianqishengqishi (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ddecffb254d25ae1045c69e679f0d81b5b6e4489bb06874481ee686038135178 Any computer that has this package installed or running should be considered...

Malicious code in hrpqvq123 (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38aee6b985b41f91e9c96ecd646b3c7918e14c51c3d97cacf792891f8f8126b8 Any computer that has this package installed or running should be considered...

MAL-2025-47069 Malicious code in hrpqwq123 (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2cebbda0574f9d3ae88ca29a1cb1e361c27a4fed067d19a24250e692a54bb8d8 Any computer that has this package installed or running should be considered...

Duplicate Advisory: Malware in @duckdb/duckdb-wasm

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w62p-hx95-gf2c. This link is maintained to preserve external references. Original Description Any computer that has this package installed or running should be considered fully compromised. All secrets and keys...

Duplicate Advisory: Malware in @duckdb/node-api

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w62p-hx95-gf2c. This link is maintained to preserve external references. Original Description Any computer that has this package installed or running should be considered fully compromised. All secrets and keys...

Duplicate Advisory: Malware in @duckdb/node-bindings

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w62p-hx95-gf2c. This link is maintained to preserve external references. Original Description Any computer that has this package installed or running should be considered fully compromised. All secrets and keys...

MAL-2025-46986 Malicious code in mcp-server-everything (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 263d07d53076b8ca1efe56fcd69d4a4e3c6d6a496b6086a03b8bafb8ae58900c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

TYPO3 CMS exposes sensitive information in an error message

Error messages containing sensitive information in the File Abstraction Layer in TYPO3 CMS versions 9.0.0-9.5.54, 10.0.0-10.4.53, 11.0.0-11.5.47, 12.0.0-12.4.36, and 13.0.0-13.4.17 allow backend users to disclose full file paths via failed low-level file-system operations...

CVE-2025-59016

TYPO3 CMS exposes an information-disclosure vulnerability (CVE-2025-59016) where error messages from the File Abstraction Layer disclose full file paths via failed low-level file-system operations. Affected versions include 9.0.0–9.5.54, 10.0.0–10.4.53, 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–...

CVE-2025-59016 Information Disclosure via File Abstraction Layer

Error messages containing sensitive information in the File Abstraction Layer in TYPO3 CMS versions 9.0.0-9.5.54, 10.0.0-10.4.53, 11.0.0-11.5.47, 12.0.0-12.4.36, and 13.0.0-13.4.17 allow backend users to disclose full file paths via failed low-level file-system operations...