Malicious code in @voiceflow/npm-package-json-lint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcb13f449b9f8582e57b2b30103359ccd3efcbde9b172f827a481af246122211 The package @voiceflow/npm-package-json-lint-config was found to contain malicious code. Source: google-open-source-security...

EUVD-2025-199509

Malicious code in @antstackio/json-to-graphql npm...

Beyond JSON: Converting Spring AI Tool Response Formats to TOON, XML, CSV, YAML, ...

JSON is the go-to format for LLM tool responses, but recent discussions around alternative formats like TOON Token-Oriented Object Notation claim potential benefits in token efficiency and performance. While the debate continues—with critical analyses pointing to context-dependent results—the...

PT-2025-48043

Name of the Vulnerable Software and Affected Versions Grype versions 0.68.0 through 0.104.0 Description Grype, a vulnerability scanner for container images and filesystems, contains a flaw where registry credentials can be improperly included in the output of a scan. This occurs when registry...

Malicious code in @tiaanduplessis/json (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 934994d3e44c6f137b7d0404fd662535084e2d850c94c0e0b421330d773e560a The package @tiaanduplessis/json was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-199133

Malicious code in @tiaanduplessis/json npm...

Malware in @tiaanduplessis/json

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

Malware in korea-administrative-area-geo-json-util

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in korea-administrative-area-geo-json-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3e5fc5ac9320c5c6de500011362abf25bbbebf4427f272bef9a58fa0d5c0f03 The package korea-administrative-area-geo-json-util was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-198720

Malicious code in korea-administrative-area-geo-json-util npm...

Liferay Portal JSON Web Services Detected

This is an informational plugin to inform the user that the scanner has detected that the target Liferay instance publicly exposes the JSON web services. No source data...

ruby:fuzz_json: Crash in json_push_value

Project: https://github.com/ruby/ruby.git Detailed Report: https://oss-fuzz.com/testcase?key=5076715287412736 Project: ruby Fuzzing Engine: libFuzzer Fuzz Target: fuzzjson Job Type: libfuzzerubsanruby Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x7c81c124fa58 Crash State:...

websocket-server-vuln-poc

websocket-server 0.6.4 — Input Validation Vulnerability PoC...

Alibaba Cloud Linux 3 : 0186: haproxy (ALINUX3-SA-2025:0186)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2025:0186 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2025-11230: Inefficient algorithm complexity in...

EUVD-2025-198335

Missing JSON Content-Type header in a script in Revive Adserver 6.0.1 and 5.5.2 and earlier versions causes a stored XSS attack to be possible for a logged in manager user...

CVE-2025-52667

Missing JSON Content-Type header in a script in Revive Adserver 6.0.1 and 5.5.2 and earlier versions causes a stored XSS attack to be possible for a logged in manager user...

CVE-2025-52667

CVE-2025-52667 affects Revive Adserver: missing JSON Content-Type header validation in a script leads to a stored XSS vulnerability for a logged-in manager user, affecting Revive Adserver 6.0.1, 5.5.2 and earlier. Connected sources (Red Hat, CNVD, NVD, OSV, HackerOne report) confirm XSS risk link...

wpsploit

WP AutoExploit Tool Alat untuk otomatis scan dan eksploit ker...

SUSE CVE-2025-65015

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. In versions from 1.3.3 to before 1.3.5 and from 1.4.0 to before 1.4.2, the ExceededSizeError exception messages are embedded with non-decoded JWT token parts and may cause...