456 matches found
MAL-2026-3854 Malicious code in @antv/ava-react (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
Malicious code in @antv/l7-three (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
Malicious code in @antv/g-perf (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
MAL-2026-3980 Malicious code in @antv/g2plot (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
MAL-2026-3929 Malicious code in @antv/g-pattern (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
MAL-2026-3918 Malicious code in @antv/g-dom-mutation-observer-api (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
MAL-2026-3910 Malicious code in @antv/g-camera-api (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
MAL-2026-3894 Malicious code in @antv/f2-my (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
PT-2026-41409
Summary Anonymous GitHub fetches repository content e.g., markdown files from GitHub's API and renders it without sanitization. On the client side, markdown is parsed with marked with sanitize: false and injected into the DOM via $sce.trustAsHtml + ng-bind-html, bypassing AngularJS's built-in XSS...
com.github.bogdanlivadariu:bootstraped-multi-test-results-report (>=0.0.2, <=1.3.0), org.jenkins-ci.main:jenkins-test-harness (1.615) +4 more potentially affected by CVE-2026-33001 via org.jenkins-ci.main:jenkins-core (1.615)
org.jenkins-ci.main:jenkins-core MAVEN version 1.615 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.github.bogdanlivadariu:bootstraped-multi-test-results-report =0.0.2, =1.76, =2.1.2, =2.1.3...
com.github.bogdanlivadariu:bootstraped-multi-test-results-report (>=0.0.2, <=1.3.0), org.jenkins-ci.main:jenkins-test-harness (1.615) +4 more potentially affected by CVE-2026-27100 via org.jenkins-ci.main:jenkins-core (1.615)
org.jenkins-ci.main:jenkins-core MAVEN version 1.615 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.github.bogdanlivadariu:bootstraped-multi-test-results-report =0.0.2, =1.76, =2.1.2, =2.1.3...
com.github.bogdanlivadariu:bootstraped-multi-test-results-report (>=0.0.2, <=1.3.0), org.jenkins-ci.main:jenkins-core (1.615) +5 more potentially affected by CVE-2025-67635 via org.jenkins-ci.main:cli (1.615)
org.jenkins-ci.main:cli MAVEN version 1.615 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:cli and may be impacted: - com.github.bogdanlivadariu:bootstraped-multi-test-results-report =0.0.2, =1.76, =2.1.2, =2.1.3 Source cves:...
com.github.bogdanlivadariu:bootstraped-multi-test-results-report (>=0.0.2, <=1.3.0), org.jenkins-ci.main:jenkins-test-harness (1.615) +4 more potentially affected by CVE-2025-67639 via org.jenkins-ci.main:jenkins-core (1.615)
org.jenkins-ci.main:jenkins-core MAVEN version 1.615 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.github.bogdanlivadariu:bootstraped-multi-test-results-report =0.0.2, =1.76, =2.1.2, =2.1.3...
com.github.bogdanlivadariu:bootstraped-multi-test-results-report (>=0.0.2, <=1.3.0), org.jenkins-ci.main:jenkins-test-harness (1.615) +4 more potentially affected by CVE-2025-67635 via org.jenkins-ci.main:jenkins-core (1.615)
org.jenkins-ci.main:jenkins-core MAVEN version 1.615 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.github.bogdanlivadariu:bootstraped-multi-test-results-report =0.0.2, =1.76, =2.1.2, =2.1.3...
com.github.bogdanlivadariu:bootstraped-multi-test-results-report (>=0.0.2, <=1.3.0), org.jenkins-ci.main:jenkins-test-harness (1.615) +4 more potentially affected by CVE-2025-67637 via org.jenkins-ci.main:jenkins-core (1.615)
org.jenkins-ci.main:jenkins-core MAVEN version 1.615 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.github.bogdanlivadariu:bootstraped-multi-test-results-report =0.0.2, =1.76, =2.1.2, =2.1.3...
com.github.bogdanlivadariu:bootstraped-multi-test-results-report (>=0.0.2, <=1.3.0), org.jenkins-ci.main:jenkins-test-harness (1.615) +4 more potentially affected by CVE-2025-67638 via org.jenkins-ci.main:jenkins-core (1.615)
org.jenkins-ci.main:jenkins-core MAVEN version 1.615 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.github.bogdanlivadariu:bootstraped-multi-test-results-report =0.0.2, =1.76, =2.1.2, =2.1.3...
com.github.bogdanlivadariu:bootstraped-multi-test-results-report (>=0.0.2, <=1.3.0), org.jenkins-ci.main:jenkins-test-harness (1.615) +4 more potentially affected by CVE-2025-67636 via org.jenkins-ci.main:jenkins-core (1.615)
org.jenkins-ci.main:jenkins-core MAVEN version 1.615 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.github.bogdanlivadariu:bootstraped-multi-test-results-report =0.0.2, =1.76, =2.1.2, =2.1.3...
CVE-2025-10281
BBOT's gitclone module could be abused to disclose a GitHub API key to an attacker controlled server with a malicious formatted git URL...
GHSA-63WH-P5FX-H4VC BBOT's git_clone.py can expose users' GitHub API keys to an attacker-controlled webserver
Summary Due to unsafe URL handling, bbot's gitclone.py can be made to leak a user's github.com API key to an attacker-controlled webserver. Impact A user who has placed their github.com API key in the configuration for any of the following modules: githubcodesearch githubworkflows gitlab gitclone...
