12069 matches found
HSEC-2023-0015 cabal-install uses expired key policies
cabal-install uses expired key policies A problem was recently discovered in cabal-install's implementation of the Hackage Security protocol that would allow an attacker who was in possession of a revoked private key and who could perform a man-in-the-middle attack against Hackage to use the...
HSEC-2025-0005 cabal-install dependency confusion
cabal-install dependency confusion For cabal-install 3.4.0.0 and where multiple repositories are configured, the resolver picks the highest available version across all repositories. Where a package is only defined in a private repository, this behaviour leads to a dependency confusionblog supply...
Malicious code in xsltproc (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 9038d06e907a027d385f7ef9111815ca61e7b26fce85196a549c20e02447adc4 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
MAL-2025-191937 Malicious code in xsltproc (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 9038d06e907a027d385f7ef9111815ca61e7b26fce85196a549c20e02447adc4 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
CVE-2024-7017
Inappropriate implementation in DevTools in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...
CVE-2024-13178
Inappropriate implementation in Fullscreen in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...
EUVD-2025-180350
Malicious code in archaeometry-rollup-plugin-astro-install npm...
EUVD-2025-178683
Malicious code in got-install-blackhole-pipe npm...
Malicious code in framework-baryon-install-iota (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cdbb94425720ebca1c18ce11aff5f460206bbdfd2717e2116a16769b295bf508 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in html-webpack-plugin-hologram-stream-install (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07f786614246d2d9d6432c8d36c1015a7c75b9a2b3c99baa78f244a48ad6eb9f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-179327
Malicious code in dependencies-galaxy-install-module npm...
EUVD-2025-175716
Malicious code in virgo-joviology-proxima-install npm...
EUVD-2025-179605
Malicious code in config-event-install-lacerta npm...
EUVD-2025-178296
Malicious code in jasmine-cypress-gravity-install npm...
EUVD-2025-177057
Malicious code in primatology-middleware-planckscale-install npm...
EUVD-2025-178386
Malicious code in install-enif-blitz-supervisor npm...
EUVD-2025-178579
Malicious code in heka-buffer-install-transform npm...
EUVD-2025-178387
Malicious code in install-enceladus-mesosphere-superflare npm...