55 matches found
CVE-2026-24131: Improper Limitation of a Pathname to a Restricted Directory
pnpm is a package manager. Prior to version 10.28.2, when pnpm processes a package's directories.bin field, it uses path.join without validating the result stays within the package root. A malicious npm package can specify "directories": "bin": "../../../../tmp" to escape the package directory,...
CVE-2025-64711
PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Starting in version 1.7.7 and prior to version 2.0.3, dragging a file whose filename contains HTML is reflected verbatim into the page via the drag-and-drop helper, so any user who drops a crafted file on...
Russian Hackers Exploit Adaptix Pentesting Tool in Ransomware Attacks
Silent Push wars of Russian hackers exploiting Adaptix, a pentesting tool built for Windows, Linux, and macOS, in ransomware campaigns...
EUVD-2019-4167
Malware in sbrugna...
EUVD-2023-29111
Malicious code in bioql PyPI...
EUVD-2024-50350
Malicious code in bioql PyPI...
EUVD-2023-29112
Malicious code in bioql PyPI...
EUVD-2025-12597
Malicious code in bioql PyPI...
EUVD-2025-12598
Malicious code in bioql PyPI...
BIT-NIFI-2022-33140 Improper Neutralization of Command Elements in Shell User Group Provider
The optional ShellUserGroupProvider in Apache NiFi 1.10.0 to 1.16.2 and Apache NiFi Registry 0.6.0 to 1.16.2 does not neutralize arguments for group resolution commands, allowing injection of operating system commands on Linux and macOS platforms. The ShellUserGroupProvider is not included in the...
CVE-2022-1030
Okta Advanced Server Access Client for Linux and macOS prior to version 1.58.0 was found to be vulnerable to command injection via a specially crafted URL. An attacker, who has knowledge of a valid team name for the victim and also knows a valid target host where the user has access, can execute...
CVE-2025-4641
CVE-2025-4641 affects bonigarcia WebDriverManager (WebDriverManager.java) and is caused by improper restriction of XML External Entity references in XML parsing components. Affected versions are 1.0.0 through before 6.0.2 (per CVE description); remediation in public advisories ranges from upgradi...
CVE-2025-46328 NodeJS Driver for Snowflake has race condition when checking access to Easy Logging configuration file
snowflake-connector-nodejs is a NodeJS driver for Snowflake. Versions starting from 1.10.0 to before 2.0.4, are vulnerable to a Time-of-Check to Time-of-Use TOCTOU race condition. When using the Easy Logging feature on Linux and macOS the Driver reads logging configuration from a user-provided...
CVE-2025-46326
Snowflake Connector for .NET has a TOCTOU race in the Linux/macOS Easy Logging config file check. Versions 2.1.2 through before 4.4.1 are vulnerable: a local attacker with write access to the logging config file or its directory could overwrite configuration, gaining control over logging level an...
HPESBNW04841 rev.1 - Multiple Vulnerabilities in HPE Aruba Networking Virtual Intranet Access (VIA) Client
Potential Security Impact: Local: Unauthorized Access to Files; Remote: Unauthenticated Arbitrary Code Execution SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba Virtual Intranet Access VIA See vulnerability summary for affected version Affected Products These vulnerabilities...
Malware Infects Linux and macOS via Typosquatted Go Packages
Socket exposes a typosquatting campaign delivering malware to Linux and macOS systems via malicious Go packages. Discover the…...
Snowflake.Data has weak temporary files permissions
Issue Snowflake discovered and remediated a vulnerability in the Snowflake Connector for .NET in which files downloaded from stages are temporarily placed in a world-readable local directory, making them accessible to unauthorized users on the same machine. This vulnerability affects versions...
SUSE CVE-2025-23013
In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. This product implements a Pluggable Authentication Module PAM that can be deployed to support authentication using a YubiKey or other FIDO compliant authenticators on macOS or Linux. This software package has an issue...
APSB24-98 : Security update available for Adobe PDFL SDK
Adobe has released an update for the Adobe PDF Library Software Development Kit SDK for Windows, Linux and macOS. Adobe PDFL SDK contains a set of functions for developing third-party solutions and workflows built upon the Adobe PDF standard. This update resolves a critical vulnerability that cou...
