MAL-2025-4612 Malicious code in react-native-google-acm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3987a453bfe3f7164232221b3a1a0f9c3c182a6581cf7a9241f4fbb7e77af649 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4734 Malicious code in com.meta.utilities (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 592e7d2fdd81405fea876197df41d2cca8625ba879c21ace66ff6e3fd9a699e5 Any computer that has this package installed or running should be considered...

Malicious code in simpledep2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 785bcea7a5a8db24e8f8da4bf42202ea0b4bc0a1628446dd0c5275e964bc422e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4671 Malicious code in @fronteg/react (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a00cbd466b7c4e34b73a25864bfbbf1d649af40b160cff27b859d85074a74fd7 Any computer that has this package installed or running should be considered...

Security Bulletin: IBM Maximo Application Suite uses cryptography-44.0.0-cp39-abi3-manylinux_2_28_x86_64.whl which is vulnerable to CVE-2024-12797.

Summary IBM Maximo Application Suite uses cryptography-44.0.0-cp39-abi3-manylinux228x8664.whl which is vulnerable to CVE-2024-12797. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2024-12797 DESCRIPTION: Issue summary: Clients using...

MAL-2025-4596 Malicious code in ext-hash (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f14959c108b475b81cfdf99aa56c08c7118e686e50a188e9af0251a8fb780e54 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Project AI 信任管理问题漏洞

Project AI is a platform by Aryan Singh Personal Developer designed to simplify the creation of AI agents using Google AI Studio. Project AI has a trust management issue vulnerability that stems from the presence of hard-coded API keys in the code...

VulnCheck KEV: CVE-2025-3935

ConnectWise ScreenConnect contains an improper authentication vulnerability. This vulnerability could allow a ViewState code injection attack, which could allow remote code execution if machine keys are compromised...

ConnectWise ScreenConnect < 25.2.4 RCE

According to its version, the ConnectWise ScreenConnect remote access software installed on the remote host is prior to 25.2.4. It is, therefore affected by a remote code execution vulnerability: - ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection...

MAL-2025-4589 Malicious code in pancakeswap-oracle-prediction (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3439b65dc3de1c6c43d4ec5ae0e3db4a1fe713e0606f8dc3037ad22dd5741467 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vite-jsconfig-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aa2206f03805567e12ada7cbae343d47492532958d8f685e73562fee9972b3b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4529 Malicious code in jwt-audit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 53e6fefcdc9ad0aef91f34767bdce289240d2c62fe34698883f251d54360dc69 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

kernel security update

4.18.0-553.54.110.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

MAL-2025-4512 Malicious code in super-randomizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 46a7beb67969c60a902fa65a47d6bd880c7de7d3d731f2cc6362efeddf2849ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4500 Malicious code in resize-plugins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cfd42601e27c2460acacb70b9c49d0443b44d78395d43a6b2491f24becdc1855 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Microsoft 3D Viewer (Windows SMB Login)

SMB login-based detection of Microsoft 3D Viewer. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-7534-1 flask vulnerability

It was discovered that Flask incorrectly handled key rotation. An attacker could possibly use this issue to sign sessions with stale keys...

MAL-2025-4573 Malicious code in nuget-trends (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e15d8438aa8bc3250a81a056153ed3922c2857a17e24e289a90822ae2362acfa Any computer that has this package installed or running should be considered...

MAL-2025-4577 Malicious code in reacts-gh (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f438d6df955eb639b0090cb670175f993ce6f6e5ce1f8d1926d236447864460 Any computer that has this package installed or running should be considered...

MAL-2025-4460 Malicious code in winstons-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c7ebc9796eae3ab4eb7380710ff205e061c750965207974c71dba9f0d8d2ae8b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...