DEBIAN-CVE-2025-23203

Icinga Director is an Icinga config deployment tool. A Security vulnerability has been found starting in version 1.0.0 and prior to 1.10.4 and 1.11.4 on several director endpoints of REST API. To reproduce this vulnerability an authenticated user with permission to access the Director is required...

CLSA-2025-1742919946 python3.9: Fix of 2 CVEs

CVE-2024-11168: fix improper validation of bracketed hosts in urllib.parse.urlsplit and urlparse functions - CVE-2025-0938: fix incomplete algorithm of validating hosts by disallowing square brackets in domain names...

Malicious code in @sensort/mongoose (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bfb2a761e35021c8cfca9951c826bdeb679e0667dae74308df6d84a5f3c10bbe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Medium: python

Issue Overview: An issue was found in the CPython zipfile module affecting versions 3.12.2, 3.11.8, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerable to "quoted-overlap" zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed...

Malicious code in my-local-b-off (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 55183046ab5c00a4004d794bf477003beb964f8267681dcd3e19c8cc97c628f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EulerOS 2.0 SP12 : python3 (EulerOS-SA-2025-1303)

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : The urllib.parse.urlsplit and urlparse functions improperly validated bracketed hosts , allowing hosts that weren't IPv6 or IPvFuture. This...

PYSEC-2025-63

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. When vLLM is configured to use Mooncake, unsafe deserialization exposed directly over ZMQ/TCP on all network interfaces will allow attackers to execute remote code on distributed hosts. This is a remote code...

CVE-2025-29783

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. When vLLM is configured to use Mooncake, unsafe deserialization exposed directly over ZMQ/TCP on all network interfaces will allow attackers to execute remote code on distributed hosts. This is a remote code...

vLLM Allows Remote Code Execution via Mooncake Integration

Summary When vLLM is configured to use Mooncake, unsafe deserialization exposed directly over ZMQ/TCP will allow attackers to execute remote code on distributed hosts. Details 1. Pickle deserialization vulnerabilities are well documented. 2. The mooncake pipe is exposed over the network by design...

CVE-2025-29783

CVE-2025-29783 affects vLLM when Mooncake is configured for KV distribution across distributed hosts. The root cause is unsafe deserialization via pickle in the mooncake_pipe path exposed over ZMQ/TCP on all network interfaces, allowing remote code execution on affected distributed hosts. Public ...

CLSA-2025-1742379028 Fix CVE(s): CVE-2024-11168, CVE-2024-4032, CVE-2025-0938

SECURITY UPDATE: Improper validation of bracketed hosts in urllib - debian/patches/CVE-2024-11168.patch: add checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format - CVE-2024-11168 SECURITY UPDATE: Incomplete validation of bracketed hosts in urllib -...

Malicious code in symphony-duplicates (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e54af5b1a89c7dc74174e2e2bd4c55e97073e7849853a7b67aa0503104e1b194 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @brix-crypto/crypto-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a7667e8bc15f436605e7a5f94dbf1a1d0534b380ead2a777826cc73ad68cf586 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mysql_nlp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 48eb776b915f1a51e587f60c794fc62cea65e0bfcbc6bf9ba1f9bc34cb2bc092 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @theoretical123/providers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e1ac0be55c85d10a80061be96a98fee35155a4a24297d95b281f4ce8226b42a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in newland-digitization-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 35b5f032125648b5b2cad6fb57b4fcf1c6ab755e93b9ca9640fc85e041bed665 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cclr-huge-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 06eea48e153d00f9562b9e23b03c116b3943d7fb1a0b903cf602c7cb63e02f2f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ccl-utilities (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77543cbed6bdb137b5e93b7486f57878a169ecb0f6ad75b0ff9a58c760f103f4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in epic-debug (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d79b6f53b73a42bf490549818051758b4fafca55d32e9d85060712adfa1b5e2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bbc-grandstand (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8f0de83cd752dd58c1c6dae7ef140c2e9e41f3eb4a7467376e80659b3019cb75 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...