8075 matches found
MONAI: Unsafe torch usage may lead to arbitrary code execution
Summary In modeldict = torch.loadfullpath, maplocation=torch.devicedevice, weightsonly=True in monai/bundle/scripts.py , weightsonly=True is loaded securely. However, insecure loading methods still exist elsewhere in the project, such as when loading checkpoints. This is a common practice when...
CVE-2025-58759
TinyEnv is an environment variable loader for PHP applications. In versions 1.0.9 and 1.0.10, TinyEnv did not properly strip inline comments inside .env values. This could lead to unexpected behavior or misconfiguration, where variables contain unintended characters including or comment text...
CVE-2025-58759 TinyEnv: Inline comments not stripped properly in .env values
TinyEnv is an environment variable loader for PHP applications. In versions 1.0.9 and 1.0.10, TinyEnv did not properly strip inline comments inside .env values. This could lead to unexpected behavior or misconfiguration, where variables contain unintended characters including or comment text...
CVE-2025-58758
TinyEnv is an environment variable loader for PHP applications. In versions 1.0.1, 1.0.2, 1.0.9, and 1.0.10, TinyEnv did not require the ".env" file to exist when loading environment variables. This could lead to unexpected behavior where the application silently ignores missing configuration,...
Denial Of Service (DoS)
org.bouncycastle, bc-fips is vulnerable to Denial Of Service DoS. The vulnerability is due to excessive allocation in the org.Bouncycastle.Crypto.Fips.NativeLoader module, which allows an attacker to exhaust system resources and cause a denial of service...
TinyEnv security vulnerability
TinyEnv is an environment variable loader for Dat Duy Personal Developer. A security vulnerability exists in TinyEnv versions 1.0.1, 1.0.2, 1.0.9, and 1.0.10, which stems from a checking deficiency in the .env file that could lead to unsafe default configurations...
CVE-2025-32321
In isSafeIntent of AccountTypePreferenceLoader.java, there is a possible way to bypass an intent type check due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
Noisy Bear Campaign Targeting Kazakhstan Energy Sector Outed as a Planned Phishing Test
A threat actor possibly of Russian origin has been attributed to a new set of attacks targeting the energy sector in Kazakhstan. The activity, codenamed Operation BarrelFire, is tied to a new threat group tracked by Seqrite Labs as Noisy Bear. The threat actor has been active since at least April...
CVE-2025-9365
Fuji Electric FRENIC-Loader 4 is vulnerable to a deserialization of untrusted data when importing a file through a specified window, which may allow an attacker to execute arbitrary code...
Malicious code in astro-postcss-loader-grunt-selenium (npm)
The package astro-postcss-loader-grunt-selenium was found to contain malicious code...
Malicious code in commitlint-sedimentology-got-css-loader (npm)
The package commitlint-sedimentology-got-css-loader was found to contain malicious code...
Malicious code in futurology-postcss-loader-vulcan-genomics (npm)
The package futurology-postcss-loader-vulcan-genomics was found to contain malicious code...
Malicious code in less-loader-ablation-frontend-transport (npm)
The package less-loader-ablation-frontend-transport was found to contain malicious code...
Malicious code in phylogenetics-adonis-postcss-loader-frontend (npm)
The package phylogenetics-adonis-postcss-loader-frontend was found to contain malicious code...
Malicious code in pyxis-sass-loader-achernar-jekyll (npm)
The package pyxis-sass-loader-achernar-jekyll was found to contain malicious code...
Malicious code in tailwindcss-tailwindcss-dotenv-safe-less-loader (npm)
The package tailwindcss-tailwindcss-dotenv-safe-less-loader was found to contain malicious code...
MAL-2025-46598 Malicious code in webdriver-manager-plutology-postcss-loader-meissa (npm)
The package webdriver-manager-plutology-postcss-loader-meissa was found to contain malicious code...
MAL-2025-46140 Malicious code in start-less-loader-got-sirius (npm)
The package start-less-loader-got-sirius was found to contain malicious code...