CVE-2025-7783 Usage of unsafe random function in form-data for choosing boundary

Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution HPP. This vulnerability is associated with program files lib/formdata.Js. This issue affects form-data: 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3...

Slackware: Security Advisory (SSA:2025-196-02)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Malicious code in dt-retag-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d21deb5c26c8d9b0043ce26b0fe5ec1625607ab1e1c37102589f92ab7187364 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5689 Malicious code in fe-lib-localstorage (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2248551164f3d70ada0fcc43237796170d7613eb7bce9bcbd718d78b64262f9b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fe-lib-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f305a62f895c51f453506e8a82753487edc589bb9dc03f1ad92dbc3b4e64dc37 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fe-lib-localstorage (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2248551164f3d70ada0fcc43237796170d7613eb7bce9bcbd718d78b64262f9b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5690 Malicious code in fe-lib-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f305a62f895c51f453506e8a82753487edc589bb9dc03f1ad92dbc3b4e64dc37 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pricing-simulator-lib (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b5c1139ad289202a8351450be1d1d9c57ca94946b8d066fbee4fa70796cc7853 Any computer that has this package installed or running should be considered...

MAL-2025-5822 Malicious code in pricing-simulator-lib (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b5c1139ad289202a8351450be1d1d9c57ca94946b8d066fbee4fa70796cc7853 Any computer that has this package installed or running should be considered...

Malicious code in company-secret-lib (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c27b257298761ee280760199b503ca3be60adbaf8ab92e36479e291e33db1b0a Any computer that has this package installed or running should be considered...

MAL-2025-5381 Malicious code in company-secret-lib (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c27b257298761ee280760199b503ca3be60adbaf8ab92e36479e291e33db1b0a Any computer that has this package installed or running should be considered...

CVE-2025-6545 pbkdf2 silently returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos supported by Node.js

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation. This vulnerability is associated with program files lib/to-buffer.Js. This issue affects pbkdf2: from 3.0.10 through 3.1.2...

CVE-2025-6545

CVE-2025-6545 (pbkdf2) : An improper input validation issue in pbkdf2 can enable signature spoofing. Affects pbkdf2 versions 3.0.10–3.1.2, with the root cause in the library’s input handling (noted as lib/to-buffer.Js). CVSS v4.0 base score 9.1 (critical). Public references describe vendor adviso...

CVE-2025-4754

Insufficient Session Expiration vulnerability in ash-project ashauthenticationphoenix allows Session Hijacking. This vulnerability is associated with program files lib/ashauthenticationphoenix/controller.ex. This issue affects ashauthenticationphoenix until 2.10.0...

Malicious code in secure-lib (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 434160e799ebf29235543a4b635db19fbdbe2ed92d2a9fb5e683f7574c9906d4 Any computer that has this package installed or running should be considered...

MAL-2025-5058 Malicious code in secure-lib (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 434160e799ebf29235543a4b635db19fbdbe2ed92d2a9fb5e683f7574c9906d4 Any computer that has this package installed or running should be considered...

@dm3-org/delivery-service (>=1.4.0 <=1.7.1), @dm3-org/dm3-backend (>=1.0.1 <=1.7.1) +18 more potentially affected by unknown CVE via @dm3-org/dm3-lib-crypto (=1.7.2)

@dm3-org/dm3-lib-crypto NPM version =1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on @dm3-org/dm3-lib-crypto and may be impacted: - @dm3-org/delivery-service =1.4.0, =1.0.1, =1.0.5, =1.0.5, =1.0.5, =1.0.5, =1.0.5, =0.0.1-alpha1, =1.0.5, =1.4.0,...

MAL-2025-5018 Malicious code in @dm3-org/dm3-lib-crypto (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in bzl_components-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e9d92ea6bf2f83b7f1ef5fda995c4ca9b06ee0c6e4666b1ac581d884dbae28f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

deno_cli (>=0.18.0-preview4 <=0.23.0), deno_cli_snapshots (>=0.0.3 <=0.19.0) +2 more potentially affected by CVE-2025-48934 via deno (>=0.15.0 <=0.6.0)

deno CARGO version =0.15.0, =0.18.0-preview4, =0.0.3, =0.0.1, =0.23.0 Source cves: CVE-2025-48934 Source advisory: OSV:GHSA-7W8P-CHXQ-2789...