Malicious code in large_clam_dumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1c4328203c1ef65f2008d59e6c3c3d50949ea2cc3e12fb34fd2c107002a7f66 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in large_catshark_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4495d3eecbd9dba56f6835e826b3fc133b33e15728089e5ebd2af6e99a72e9d3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-53587

Malicious code in large-moccasin-egret npm...

EUVD-2025-53588

Malicious code in large-fuchsia-wasp npm...

EUVD-2025-53586

Malicious code in large-salmon-rodent npm...

EUVD-2025-53585

Malicious code in large-scarlet-tarantula npm...

EUVD-2025-53589

Malicious code in large-azure-badger npm...

From LLMs to Agents: A Comparative Evaluation of LLMs and LLM-Based Agents in Security Patch Detection

The widespread adoption of open-source software OSS has accelerated software innovation but also increased security risks due to the rapid propagation of vulnerabilities and silent patch releases. In recent years, large language models LLMs and LLM-based agents have demonstrated remarkable...

ALSA-2025:21030 Important: expat security update

Expat is a C library for parsing XML documents. Security Fixes: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing CVE-2025-59375 For more details about the security issues, including the impact, a CVSS score,...

PT-2025-46377

Name of the Vulnerable Software and Affected Versions NVIDIA Triton Inference Server for Linux and Windows affected versions not specified Description The NVIDIA Triton Inference Server is susceptible to a stack overflow condition triggered by the reception of excessively large payloads...

RHEL 10 : expat (RHSA-2025:21030)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:21030 advisory. Expat is a C library for parsing XML documents. Security Fixes: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocatio...

CVE-2025-64529

SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions prior to 1.45.2, users who use the exclusion operator somewhere in their authorization schema; have configured their SpiceDB server such that...

CVE-2025-64529

SpiceDB prior to v1.45.2 is affected when the exclusion operator is used and a per-call payload is large due to --write-relationships-max-updates-per-call > 6500. In this scenario, WriteRelationships can return success for a failed operation and produce incorrect permission results if the affe...

Malicious code in large_marlin_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d62c25a991aec2f20a536f7276148e87601a2fcd831c728a0f0379fb408be518 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-46653

Malicious code in largedragonz3n npm...

Denial-of-Service (DoS)

rack is vulnerable to Denial-Of-Service. The vulnerability is due to Rack::RequestPOST reading the entire application/x-www-form-urlencoded body into memory due to calling rack.input.readnil without enforcing a length limit, and attackers can send very large form bodies to exhaust process memory...

DrAttack

DrAttack: Prompt Decomposition and Reconstruction Makes Powerf...

libtiff: Libtiff Write-What-Where

A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file. By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controll...

rack: Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)

A flaw was found in Rack where Rack::Multipart::Parser stores non-file form fields entirely in memory without size limits. An attacker can send a multipart/form-data request with an extremely large text field, causing the server to allocate large amounts of memory which leads to a denial of servi...

LLM Response Evaluation with Spring AI: Building LLM-as-a-Judge Using Recursive Advisors

The challenge of evaluating Large Language Model LLM outputs is critical for notoriously non-deterministic AI applications, especially as they move into production. Traditional metrics like ROUGE and BLEU fall short when assessing the nuanced, contextual responses that modern LLMs produce. Human...