MAL-2025-10727 Malicious code in @zalastax/nolb-autoc (npm)

The package @zalastax/nolb-autoc was found to contain malicious code...

MAL-2025-19628 Malicious code in emmet-sketch (npm)

The package emmet-sketch was found to contain malicious code...

MAL-2025-10209 Malicious code in @zalastax/nolb-_matd (npm)

The package @zalastax/nolb-matd was found to contain malicious code...

MAL-2025-25152 Malicious code in leomira (npm)

The package leomira was found to contain malicious code...

MAL-2025-22035 Malicious code in guess-zodiac (npm)

The package guess-zodiac was found to contain malicious code...

MAL-2025-10184 Malicious code in @zalastax/nolb-_leb (npm)

The package @zalastax/nolb-leb was found to contain malicious code...

MAL-2025-13506 Malicious code in @zalastax/nolb-quas (npm)

The package @zalastax/nolb-quas was found to contain malicious code...

BELL-CVE-2025-22840

Bulletin has no description...

CLSA-2025-1754381382 git: Fix of CVE-2025-27613

CVE-2025-27613: fix vulnerability where Gitk can write and truncate arbitrary writable files...

AZL-66060 CVE-2025-54349 affecting package iperf3 for versions less than 3.17.1-3

In iperf before 3.19.1, iperfauth.c has an off-by-one error and resultant heap-based buffer overflow...

CVE-2025-1708

The application is vulnerable to SQL injection attacks. An attacker is able to dump the PostgreSQL database and read its content...

AlmaLinux 9 : perl-FCGI (ALSA-2025:8635)

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2025:8635 advisory. perl-fcgi: FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 aka fcgi library CVE-2025-40907 Tenable has extracted the...

CVE-2024-47081 Requests vulnerable to .netrc credentials leak via malicious URLs

Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be...

CVE-2024-47877

Extract is aA Go library to extract archives in zip, tar.gz or tar.bz2 formats. A maliciously crafted archive may allow an attacker to create a symlink outside the extraction target directory. This vulnerability is fixed in 4.0.0. If you're using the Extractor.FS interface, then upgrading to /v4...

CVE-2023-44378

gnark is a zk-SNARK library that offers a high-level API to design circuits. Prior to version 0.9.0, for some in-circuit values, it is possible to construct two valid decomposition to bits. In addition to the canonical decomposition of a, for small values there exists a second decomposition for a...

CVE-2023-38699

MindsDB's AI Virtual Database allows developers to connect any AI/ML model to any datasource. Prior to version 23.7.4.0, a call to requests with verify=False disables SSL certificate checks. This rule enforces always verifying SSL certificates for methods in the Requests library. In version...

CVE-2021-41150

Tough provides a set of Rust libraries and tools for using and generating the update framework TUF repositories. The tough library, prior to 0.12.0, does not properly sanitize delegated role names when caching a repository, or when loading a repository from the filesystem. When the repository is...

CVE-2019-19391

In LuaJIT through 2.0.5, as used in Moonjit before 2.1.2 and other products, debug.getinfo has a type confusion issue that leads to arbitrary memory write or read operations, because certain cases involving valid stack levels and options are mishandled. NOTE: The LuaJIT project owner states that...

LibVulnWatch: a Deep Assessment Agent System and Leaderboard for Uncovering Hidden Vulnerabilities in Open-Source AI Libraries

Open-source AI libraries are foundational to modern AI systems but pose significant, underexamined risks across security, licensing, maintenance, supply chain integrity, and regulatory compliance. We present LibVulnWatch, a graph-based agentic assessment framework that performs deep,...

RLSA-2024:4249 Low: c-ares security update

The c-ares C library defines asynchronous DNS Domain Name System requests and provides name resolving API. Security Fixes: c-ares: Out of bounds read in aresreadline CVE-2024-25629 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related...