MAL-2025-105609 Malicious code in marginal_bison-notthedev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9566e4c975bdf1f1a08f9116aaa821517b6280b5c3d34ebc64a762440b71ef8b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2005-0914

Malware in sbrugna...

EUVD-2018-8889

Malware in sbrugna...

EUVD-2018-21569

Malware in sbrugna...

EUVD-2018-2563

Malware in sbrugna...

EUVD-2019-17706

Malware in sbrugna...

EUVD-2024-53128

Malicious code in bioql PyPI...

EUVD-2022-30014

Malicious code in bioql PyPI...

EUVD-2025-3448

Malicious code in bioql PyPI...

MAL-2025-46148 Malicious code in string-modifier-utils (npm)

The package string-modifier-utils was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...

Malicious code in string-modifier-utils (npm)

The package string-modifier-utils was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...

CVE-2025-58050

Concrete details confirm CVE-2025-58050 affects PCRE2 10.45, with a heap-buffer-overflow in the regex engine when processing the Scan SubString verb combined with ACCEPT in pcre2_match.c. The issue can cause information disclosure via out-of-bounds reads that may influence final match results. A ...

CVE-2025-50567

Saurus CMS Community Edition 4.7.1 contains a vulnerability in the custom DB::prepare function, which uses pregreplace with the deprecated /e eval modifier to interpolate SQL query parameters. This leads to injection of user-controlled SQL statements, potentially leading to arbitrary PHP code...

CVE-2025-50567

Saurus CMS Community Edition 4.7.1 contains a vulnerability in the custom DB::prepare function, which uses pregreplace with the deprecated /e eval modifier to interpolate SQL query parameters. This leads to injection of user-controlled SQL statements, potentially leading to arbitrary PHP code...

CVE-2025-50567

Saurus CMS Community Edition version 4.7.1 is vulnerable to a security flaw within the custom DB::prepare() function. The root cause is the use of preg_replace() with the deprecated /e (eval) modifier to interpolate SQL query parameters, which allows for the injection of user-controlled SQL state...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: db-operator-fips, prometheus-podman-exporter, amazon-ssm-agent-fips, rancher-security-scan-fips, kubo, spicedb, kbld, helm-operator-fips, kiam, bom, witness, gitness, kyverno, cass-operator, grafana-agent-operator, argocd-image-updater, rancher-fleet, kubeflow,...

CVE-2022-25335

RigoBlock Dragos through 2022-02-17 lacks the onlyOwner modifier for setMultipleAllowances. This enables token manipulation, as exploited in the wild in February 2022. NOTE: although 2022-02-17 is the vendor's vulnerability announcement date, the vulnerability will not be remediated until a major...

CVE-2020-19765

An issue in the noReentrance modifier of the Ethereum-based contract Accounting 1.0 allows attackers to carry out a reentrancy attack...

Xorg: xwayland: Buffer overflow in XkbVModMaskText()

A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText allocates a fixed-sized buffer on the stack and copies the names of the virtual modifiers to that buffer. The code fails to check the bounds of the buffer and would copy the data regardless of the size...

Security Bulletin: A vulnerability in IBM Robotic Process Automation may result in exposure of the name and email for the creator/modifier of platform level objects (CVE-2022-43573)

Summary There is a vulnerability in IBM Robotic Process Automation. Accessing specific platform level objects created in RPA may expose the creator or modifiers email address. This bulletin identifies the security fixes to apply to address this vulnerability. Vulnerability Details...