CVE-2025-30218 Next.js may leak x-middleware-subrequest-id to external hosts

Next.js is a React framework for building full-stack web applications. To mitigate CVE-2025-29927, Next.js validated the x-middleware-subrequest-id which persisted across multiple incoming requests. However, this subrequest ID is sent to all requests, even if the destination is not the same host ...

CVE-2025-30218

Next.js (React framework) contains a vulnerability where x-middleware-subrequest-id is exposed to third-party destinations when a fetch to a different host occurs inside Middleware. Root cause: subrequest-id validation persisted across requests whereas destinations can differ, allowing informatio...

Malicious code in niji-react-input (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 308202af28f18471be931243021c6ecf4079323996579d3da01c5b193e94bc7f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mocha-appscan-reporter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 21793e2495135513c49a9203796dd0cd7f455829773a96ca4e1ba435705f1533 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in timezone-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7dad5ea04a94ca53aac985d529d7818721f79a32388872b0f886ecd9af98385a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

DEBIAN-CVE-2025-23203

Icinga Director is an Icinga config deployment tool. A Security vulnerability has been found starting in version 1.0.0 and prior to 1.10.4 and 1.11.4 on several director endpoints of REST API. To reproduce this vulnerability an authenticated user with permission to access the Director is required...

CLSA-2025-1742919946 python3.9: Fix of 2 CVEs

CVE-2024-11168: fix improper validation of bracketed hosts in urllib.parse.urlsplit and urlparse functions - CVE-2025-0938: fix incomplete algorithm of validating hosts by disallowing square brackets in domain names...

Malicious code in @sensort/mongoose (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bfb2a761e35021c8cfca9951c826bdeb679e0667dae74308df6d84a5f3c10bbe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Medium: python

Issue Overview: An issue was found in the CPython zipfile module affecting versions 3.12.2, 3.11.8, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerable to "quoted-overlap" zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed...

Malicious code in my-local-b-off (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 55183046ab5c00a4004d794bf477003beb964f8267681dcd3e19c8cc97c628f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EulerOS 2.0 SP12 : python3 (EulerOS-SA-2025-1303)

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : The urllib.parse.urlsplit and urlparse functions improperly validated bracketed hosts , allowing hosts that weren't IPv6 or IPvFuture. This...

PYSEC-2025-63

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. When vLLM is configured to use Mooncake, unsafe deserialization exposed directly over ZMQ/TCP on all network interfaces will allow attackers to execute remote code on distributed hosts. This is a remote code...

CVE-2025-29783

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. When vLLM is configured to use Mooncake, unsafe deserialization exposed directly over ZMQ/TCP on all network interfaces will allow attackers to execute remote code on distributed hosts. This is a remote code...

vLLM Allows Remote Code Execution via Mooncake Integration

Summary When vLLM is configured to use Mooncake, unsafe deserialization exposed directly over ZMQ/TCP will allow attackers to execute remote code on distributed hosts. Details 1. Pickle deserialization vulnerabilities are well documented. 2. The mooncake pipe is exposed over the network by design...

CVE-2025-29783

CVE-2025-29783 affects vLLM when Mooncake is configured for KV distribution across distributed hosts. The root cause is unsafe deserialization via pickle in the mooncake_pipe path exposed over ZMQ/TCP on all network interfaces, allowing remote code execution on affected distributed hosts. Public ...

CLSA-2025-1742379028 Fix CVE(s): CVE-2024-11168, CVE-2024-4032, CVE-2025-0938

SECURITY UPDATE: Improper validation of bracketed hosts in urllib - debian/patches/CVE-2024-11168.patch: add checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format - CVE-2024-11168 SECURITY UPDATE: Incomplete validation of bracketed hosts in urllib -...

Malicious code in symphony-duplicates (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e54af5b1a89c7dc74174e2e2bd4c55e97073e7849853a7b67aa0503104e1b194 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @brix-crypto/crypto-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a7667e8bc15f436605e7a5f94dbf1a1d0534b380ead2a777826cc73ad68cf586 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mysql_nlp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 48eb776b915f1a51e587f60c794fc62cea65e0bfcbc6bf9ba1f9bc34cb2bc092 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @theoretical123/providers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e1ac0be55c85d10a80061be96a98fee35155a4a24297d95b281f4ce8226b42a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...