MAL-2025-26916 Malicious code in mutation-xml-hologram-andromeda (npm)

The package mutation-xml-hologram-andromeda was found to contain malicious code...

MAL-2025-26914 Malicious code in mutation-terser-webpack-plugin-metabolomics-mensa (npm)

The package mutation-terser-webpack-plugin-metabolomics-mensa was found to contain malicious code...

MAL-2025-29394 Malicious code in playwright-mutation-mysql-solis (npm)

The package playwright-mutation-mysql-solis was found to contain malicious code...

MAL-2025-15975 Malicious code in bootes-mutation-eleventy-zephyr (npm)

The package bootes-mutation-eleventy-zephyr was found to contain malicious code...

MAL-2025-26913 Malicious code in mutation-child-process-repository-xerxes (npm)

The package mutation-child-process-repository-xerxes was found to contain malicious code...

MAL-2025-29534 Malicious code in postcss-cordelia-mutation-cz-conventional-changelog (npm)

The package postcss-cordelia-mutation-cz-conventional-changelog was found to contain malicious code...

Malicious code in biomimicry-supercluster-apollo-mutation (npm)

The package biomimicry-supercluster-apollo-mutation was found to contain malicious code...

Malicious code in mutation-xml-hologram-andromeda (npm)

The package mutation-xml-hologram-andromeda was found to contain malicious code...

Malicious code in playwright-mutation-mysql-solis (npm)

The package playwright-mutation-mysql-solis was found to contain malicious code...

MAL-2025-26915 Malicious code in mutation-uninstall-node-config-version (npm)

The package mutation-uninstall-node-config-version was found to contain malicious code...

MAL-2025-38924 Malicious code in wavefunction-rocket-mutation-json (npm)

The package wavefunction-rocket-mutation-json was found to contain malicious code...

MAL-2025-39755 Malicious code in xerxes-mutation-dysonswarm-supernova (npm)

The package xerxes-mutation-dysonswarm-supernova was found to contain malicious code...

Out-of-bounds access in `get_disjoint_mut` due to incorrect bounds check

Impact The getdisjointmut method in slab v0.4.10 incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. Patches This has been fixed in slab v0.4.11. Workarounds Avoi...

Linux Distros Unpatched Vulnerability : CVE-2024-3858

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - It was possible to mutate a JavaScript object so that the JIT could crash while tracing it. This vulnerability affects Firefox 125. CVE-2024-3858 Note that Ness...

GHSA-QX2V-8332-M4FV slab allows out-of-bounds access in `get_disjoint_mut` due to incorrect bounds check

Impact The getdisjointmut method in slab v0.4.10 incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. Patches This has been fixed in slab v0.4.11. Workarounds Avoi...

Generative AI for Critical Infrastructure in Smart Grids: a Unified Framework for Synthetic Data Generation and Anomaly Detection

In digital substations, security events pose significant challenges to the sustained operation of power systems. To mitigate these challenges, the implementation of robust defense strategies is critically important. A thorough process of anomaly identification and detection in information and...

HackerOne: DOS via Mutation Aliasing in GraphQL Account Recovery Phone Number Verification API

The GraphQL API's 'verifyAccountRecoveryPhoneNumber' mutation was found to be vulnerable to denial-of-service attacks through mutation aliasing. The vulnerability allowed multiple aliases of the same mutation to be included in a single request, causing the server to process each mutation...

Go Assembly Mutation Testing

While maintaining and developing the Go cryptography standard library, we often spend significantly more time on testing than on implementation. That’s good and an important part of how we achieve our excellent security track record. Ideally, this would be especially true for the least safe parts...

CVE-2025-46732 OpenCTI's GraphQL IDOR enables authenticated users to modify or delete notifications of other users

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.6.6, an IDOR vulnerability in the GrapQL NotificationLineNotificationMarkReadMutation and NotificationLineNotificationDeleteMutation mutations of OpenCTI allows an authenticated...

CVE-2025-53641 Postiz allows header mutation in middleware facilitates resulting in SSRF

Postiz is an AI social media scheduling tool. From 1.45.1 to 1.62.3, the Postiz frontend application allows an attacker to inject arbitrary HTTP headers into the middleware pipeline. This flaw enables a server-side request forgery SSRF condition, which can be exploited to initiate unauthorized...