Malicious code in manual-tan-hookworm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 275fa0901a0afbdee4a664b45c4c27f96141627a4474584bd78ad62221401d5d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-53357

Malicious code in manual-indigo-cephalopod npm...

EUVD-2025-53356

Malicious code in manual-lime-kite npm...

EUVD-2025-53355

Malicious code in manual-tan-hookworm npm...

EUVD-2025-53358

Malicious code in manual-black-bovid npm...

EUVD-2025-49856

Malicious code in manualsilverfishz3n npm...

SUSE CVE-2025-62375

go-witness and witness are Go modules for generating attestations. In go-witness versions 0.8.6 and earlier and witness versions 0.9.2 and earlier the AWS attestor improperly verifies AWS EC2 instance identity documents. Verification can incorrectly succeed when a signature is not present or is...

SUSE CVE-2024-25621

containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an overly broad default permission vulnerability. Directory paths /var/lib/containerd,...

Malicious Package

Overview vite-manual-chunker is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in vite-manual-chunker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2466db729b423d58b084a5f99834cfaf8c62af4179350ef30978e32f36b50fa7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48914 Malicious code in vite-manual-chunker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2466db729b423d58b084a5f99834cfaf8c62af4179350ef30978e32f36b50fa7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2025-36420

Malicious code in vite-manual-chunker npm...

GHSA-J4VR-PCMW-HX59 Rancher user retains access to clusters despite Global Role removal

Impact A vulnerability has been identified within Rancher Manager, where after removing a custom GlobalRole that gives administrative access or the corresponding binding, the user still retains access to clusters. This only affects custom Global Roles that: - Have a on in rule for resources - Hav...

CVE-2025-53702 DoS vulnerability in Vilar VS-IPC1002 IP cameras

Vilar VS-IPC1002 IP cameras are vulnerable to DoS Denial-of-Service attacks. An unauthenticated attacker on the same local network might send a crafted request to /cgi-bin/action endpoint and render the device completely unresponsive. A manual restart of the device is required. The vendor did not...

DRUPAL-CONTRIB-2025-112

CivicTheme is a design system and theme framework used to build content-rich Drupal websites. It includes editorial workflows, structured content types, and flexible theming components. The theme doesn't sufficiently check access to entities when they are displayed as reference cards used in manu...

JLSEC-2025-184 libgit2 is a cross-platform, linkable library implementation of Git

libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with the optional libssh2 backend, libgit2 does not perform certificate checking by default. Prior versions of libgit2 require the caller to set the certificatecheck field of libgit2's gitremotecallbacks...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987526)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987526 advisory. In the Linux kernel, the following vulnerability has been resolved: net: dsa: felix: don't use devres for mdiobus As explained in commits: 74b6d7d13307 net: dsa:...

📄 Greenlife.bg SQL Injection

Greenlife.bg appears to suffer from a remote SQL injection vulnerability. It is unclear what vulnerable code base is being used or if it's custom, however, the researcher has not heard a response from the vendor and they have not addressed the issue, putting their users at risk, so this is being...

CVE-2025-62375

go-witness and witness are Go modules for generating attestations. In go-witness versions 0.8.6 and earlier and witness versions 0.9.2 and earlier the AWS attestor improperly verifies AWS EC2 instance identity documents. Verification can incorrectly succeed when a signature is not present or is...

CVE-2025-62375

go-witness and witness are Go modules for generating attestations. In go-witness versions 0.8.6 and earlier and witness versions 0.9.2 and earlier the AWS attestor improperly verifies AWS EC2 instance identity documents. Verification can incorrectly succeed when a signature is not present or is...