MAL-2025-2634 Malicious code in @sensort/cron (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7c0ebacc703edeb057fef3431d63da809c1a943796b8a82b6f14c9fe31f116e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2666 Malicious code in ebtc-zap-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f338c68f960df4bcaa54c3a4dbcd77e570a1015d1ac4ada59252e11f4f35d335 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2665 Malicious code in discourse-web3auth-theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 22290c7662af2d58b4706977dcf0e780e9aa9f028a6d15d75e47831ab96362f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2716 Malicious code in vistar-ad-clienttestadv3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 998a79c7a6246c56acd40382f70e1cfab273a5002ff94a5242bb0bb12b8dc962 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2714 Malicious code in truchuhhbuh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e8810fe0d195e5777e68fcf99f39f501f98ab2b6d41bc2b49fbdb4c97751559e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2619 Malicious code in my-account-end-game (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware affc2e67711261a8284c0193acc1a7c7afa56ee2693d1c6ca1d5cde32ca11376 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2617 Malicious code in epic-react-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6d43c90ef27f311e9b6bb49fb715a80a16f68e0adef519b5f389a00ceeb8bbf3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-0330

In berriai/litellm version v1.52.1, an issue in proxyserver.py causes the leakage of Langfuse API keys when an error occurs while parsing team settings. This vulnerability exposes sensitive information, including langfusesecret and langfusepublickey, which can provide full access to the Langfuse...

CVE-2024-12866

A local file inclusion vulnerability exists in netease-youdao/qanything version v2.0.0. This vulnerability allows an attacker to read arbitrary files on the file system, which can lead to remote code execution by retrieving private SSH keys, reading private files, source code, and configuration...

CVE-2024-9099

In lunary-ai/lunary version v1.4.29, the GET /projects API endpoint exposes both public and private API keys for all projects to users with minimal permissions, such as Viewers or Prompt Editors. This vulnerability allows unauthorized users to retrieve sensitive credentials, which can be used to...

CLSA-2025-1742577500 Fix CVE(s): CVE-2017-12166

SECURITY UPDATE: Possible inject of arbitrary data into third-party executables or plug-ins - debian/patches/CVE-2017-12166.patch: Fix an out-of-bounds issue preventing potential stack overflow - CVE-2017-12166 UPDATE CERTIFICATES: Renew sample keys - debian/patches/sample-keys-renew.patch: Renew...

OESA-2025-1327 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the functions EVPPKEYparamcheck or...

OESA-2025-1326 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the functions EVPPKEYparamcheck or...

CVE-2025-30234

SmartOS, as used in Triton Data Center and other products, has static host SSH keys in the 60f76fd2-143f-4f57-819b-1ae32684e81b image a Debian 12 LX zone image from 2024-07-26...

MAL-2025-2573 Malicious code in keypair-encryption (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1265d869c665e7bb42b4827bc9f51ad572b2ce181edebfc84eeb5698e0e39048 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-879V-FGGM-VXW2 LiteLLM Has a Leakage of Langfuse API Keys

In berriai/litellm version v1.52.1, an issue in proxyserver.py causes the leakage of Langfuse API keys when an error occurs while parsing team settings. This vulnerability exposes sensitive information, including langfusesecret and langfusepublickey, which can provide full access to the Langfuse...

LiteLLM Has a Leakage of Langfuse API Keys

In berriai/litellm version v1.52.1, an issue in proxyserver.py causes the leakage of Langfuse API keys when an error occurs while parsing team settings. This vulnerability exposes sensitive information, including langfusesecret and langfusepublickey, which can provide full access to the Langfuse...

CLSA-2025-1742472545 kernel: Fix of 9 CVEs

USB: serial: ioedgeport: fix use after free in debug printk CVE-2024-50267 - HID: core: zero-initialize the report buffer CVE-2024-50302 - dm cache: fix potential out-of-bounds access on the first resume CVE-2024-50278 - dm cache: fix out-of-bounds access to the dirty bitset when resizing...

CLSA-2025-1742471200 kernel: Fix of 19 CVEs

net: defer final 'struct net' free in netns dismantle CVE-2024-56658 - smb: client: fix potential deadlock when releasing mids CVE-2023-52757 - tcp/dccp: Don't use timerpending in reqskqueueunlink. CVE-2024-50154 - ALSA: 6fire: Release resources at card release CVE-2024-53239 - smb: client: fix...

Improper Output Neutralization for Logs

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Improper Output Neutralization for Logs due to the incomplete masking of API keys in the logging functionality. An attacker can expose sensitive information by accessing th...