Malicious code in node-telegram-sdk (npm)

This package adds the attacker's public SSH key to the user's authorizedkeys file, creating a backdoor. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64fa53b655e6444ccce46488f04d3dcf7f427354b64c286c652de18e947c2c74 Any computer that has this package installed or...

Malicious code in hardhat-configs (npm)

This package exfiltrates sensitive Ethereum-related data such as mnemonics and private keys to an attacker-controlled server. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 98317ddb2bbad731c7576eb5f64b3a91f7e6f7bd135fa5ef05b7a2ad3da15992 Any computer that has this...

MAL-2025-626 Malicious code in hardhat-configs (npm)

This package exfiltrates sensitive Ethereum-related data such as mnemonics and private keys to an attacker-controlled server. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 98317ddb2bbad731c7576eb5f64b3a91f7e6f7bd135fa5ef05b7a2ad3da15992 Any computer that has this...

Malicious code in @nomicsfondation/hardhat-configs (npm)

This package exfiltrates sensitive Ethereum-related data such as mnemonics and private keys to an attacker-controlled server. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 72a47b5bdfeac96982433856ac791ab0638f2d6f64f388ceb2a284f35597c37a Any computer that has this...

MAL-2025-623 Malicious code in @nomicsfondation/hardhat-configs (npm)

This package exfiltrates sensitive Ethereum-related data such as mnemonics and private keys to an attacker-controlled server. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 72a47b5bdfeac96982433856ac791ab0638f2d6f64f388ceb2a284f35597c37a Any computer that has this...

Malicious code in telegram-util (npm)

This package adds the attacker's public SSH key to the user's authorizedkeys file, creating a backdoor. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 259b69f583bb3ea0fcb76890f5361a9c8e9d784fcca352a51f4dd13e7d73e1c7 Any computer that has this package installed or...

MAL-2025-627 Malicious code in node-telegram-bot-sdk (npm)

This package adds the attacker's public SSH key to the user's authorizedkeys file, creating a backdoor. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eac040b96e06268d2909a10c620df0339df7c2f6cef468c8c0e3cca3ce347c8f Any computer that has this package installed or...

Malicious code in grammy-utils (npm)

This package adds the attacker's public SSH key to the user's authorizedkeys file, creating a backdoor. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 722622ea790d1aa9a24e9418f5f3480a09e5501b039fa8256d60bba00291e894 Any computer that has this package installed or...

Exposed DeepSeek Database Revealed Chat Prompts and Internal Data

China-based DeepSeek has exploded in popularity, drawing greater scrutiny. Case in point: Security researchers found more than 1 million records, including user data and API keys, in an open database...

SUSE-SU-2025:0285-1 Security update for go1.24

This update for go1.24 fixes the following issues: This update ships go1.24rc2 bsc1236217. - CVE-2024-45341: Properly check for IPv6 hosts in URIs bsc1236045 - CVE-2024-45336: Persist header stripping across repeated redirects bsc1236046 - CVE-2025-22865: Avoid panic when parsing partial PKCS1...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.24 (SUSE-SU-2025:0285-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0285-1 advisory. This update ships go1.24rc2 bsc1236217. - CVE-2024-45341: Properly check for IPv6 hosts in URIs...

CVE-2024-48310

AutoLib Software Systems OPAC v20.10 was discovered to have multiple API keys exposed within the source code. Attackers may use these keys to access the backend API or other sensitive information...

Remote Code Execution (RCE)

craftcms/cms is vulnerable to Remote Code Execution RCE. The vulnerability is due to compromised security keys, which allow attackers to execute arbitrary code on affected installations...

CVE-2025-22865 ParsePKCS1PrivateKey panic with partial keys in crypto/x509

Using ParsePKCS1PrivateKey to parse a RSA key that is missing the CRT values would panic when verifying that the key is well formed...

CVE-2025-22865 ParsePKCS1PrivateKey panic with partial keys in crypto/x509

Using ParsePKCS1PrivateKey to parse a RSA key that is missing the CRT values would panic when verifying that the key is well formed...

Uncaught Exception

Overview std/crypto/x509 is a Go standard library package std/crypto/x509 Affected versions of this package are vulnerable to Uncaught Exception. Go Vulnerability Report: Using ParsePKCS1PrivateKey to parse a RSA key that is missing the CRT values would panic when verifying that the key is well...

Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2025-20066)

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-20066 advisory. - NFSD: Limit the number of concurrent async COPY operations Chuck Lever Orabug: 37516381 CVE-2024-49974 - NFSD: Async COPY result needs to return...

AutoLib Software Systems OPAC 20.10 Secret Disclosure

AutoLib Software Systems OPAC version 20.10 discloses multiple API keys within the source code. Attackers may use these keys to access the backend API or other sensitive information. + Credits: Shahnawaz Shaikh, Security Researcher at Cybergate Defense LLC + twitter.com/striv3r Vendor Autolib-ind...

CVE-2024-48310

AutoLib Software Systems OPAC v20.10 was discovered to have multiple API keys exposed within the source code. Attackers may use these keys to access the backend API or other sensitive information...

AutoLib Software Systems OPAC 安全漏洞

AutoLib Software Systems OPAC is a library management software from AutoLib Software Systems. A security vulnerability exists in AutoLib Software Systems OPAC version v20.10, which stems from the exposure of multiple API keys in the code. An attacker could use these keys to access back-end APIs o...