CVE-2025-30353 Directus's webhook trigger flows can leak sensitive data

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.5.0, when a Flow with the "Webhook" trigger and the "Data of Last Operation" response body encounters a ValidationError thrown by a failed condition operation, the A...

Sensitive Information Disclosure

LiteLLM is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper error handling due to an issue in proxyserver.py that leaks Langfuse API keys when an error occurs while parsing team settings, potentially exposing full access to stored requests...

kernel security update

5.14.0-503.34.15.OL9 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

container-tools:ol8 security update

aardvark-dns buildah cockpit-podman conmon containernetworking-plugins containers-common 1-82.0.1 - Updated removed references Orabug: 33473101 Alex Burmashev - Adjust registries.conf Nikita Gerasimov - remove references to RedHat registry Nikita Gerasimov 2:1-82 - update vendored components -...

MAL-2025-2661 Malicious code in consolidate-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cabd5f8487415db9bef4d60ff036c16f1390e7d129fa4fbd96045e096eb1e897 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2725 Malicious code in yxt-fe-center (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eefdd1eb0ce0a6fc7fac81b2bf725420903465a02f853bddcce53bb22c9463ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2680 Malicious code in internallib_v72 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cfd62ceee47f0cd86d2f4187fac0af99eb626f31eecad5929dcd0d7797ec95ae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2675 Malicious code in gson-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fd315ab6614bdf716d90b22ff2804ff7594f8bfe856133c0d60bebaf9d241e79 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2707 Malicious code in sfapm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 853b53676c5023f880be7c158c82254598429dca281399a1d04fb433be3e7908 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2638 Malicious code in @sensort/session (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 96a646a0d38e8f89c8ecec7448085706baab46e90a7e46c14c3d819d971dab7b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @sensort/mongoose-migrations (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d546ccd4e110a5e2cdd36b9823cddd0fc873607ff587abfa2761ce711a5896bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2634 Malicious code in @sensort/cron (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7c0ebacc703edeb057fef3431d63da809c1a943796b8a82b6f14c9fe31f116e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2666 Malicious code in ebtc-zap-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f338c68f960df4bcaa54c3a4dbcd77e570a1015d1ac4ada59252e11f4f35d335 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2665 Malicious code in discourse-web3auth-theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 22290c7662af2d58b4706977dcf0e780e9aa9f028a6d15d75e47831ab96362f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2716 Malicious code in vistar-ad-clienttestadv3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 998a79c7a6246c56acd40382f70e1cfab273a5002ff94a5242bb0bb12b8dc962 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2714 Malicious code in truchuhhbuh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e8810fe0d195e5777e68fcf99f39f501f98ab2b6d41bc2b49fbdb4c97751559e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2619 Malicious code in my-account-end-game (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware affc2e67711261a8284c0193acc1a7c7afa56ee2693d1c6ca1d5cde32ca11376 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2617 Malicious code in epic-react-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6d43c90ef27f311e9b6bb49fb715a80a16f68e0adef519b5f389a00ceeb8bbf3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-0330

In berriai/litellm version v1.52.1, an issue in proxyserver.py causes the leakage of Langfuse API keys when an error occurs while parsing team settings. This vulnerability exposes sensitive information, including langfusesecret and langfusepublickey, which can provide full access to the Langfuse...

CVE-2024-12866

A local file inclusion vulnerability exists in netease-youdao/qanything version v2.0.0. This vulnerability allows an attacker to read arbitrary files on the file system, which can lead to remote code execution by retrieving private SSH keys, reading private files, source code, and configuration...