CVE-2025-12967

An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow privilege escalation to the rds_superuser role via a crafted function executed by a low-privileged authenticated user. Affected wrappers include AWS JDBC Wrapper, AWS Go Wrapper, AWS NodeJS Wrapper, AWS Python Wrapper, and AWS PGSQL ...

EUVD-2025-46063

Malicious code in obligedshrewz3n npm...

EUVD-2025-45828

Malicious code in patria-toge18-sukiwir npm...

EUVD-2025-48432

Malicious code in cici-kue63-sukiwir npm...

MAL-2025-57825 Malicious code in nina-mangut55-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b0f91457c1007b8577ec54f2357d82e5e7f0bf7af2c7728e4eee9508d267fcd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-59341 Malicious code in vina-miebogor27-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a75e2a47d4cd25ec9bc548fb7920539e91e87de0841cf271b94640ef3888bf77 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in joko-takokak71-pore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5242f4bad2527fcdd593e09e1516143c385b4b8f7b5ac369f9a4f4a1093800de This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-41573

Malicious code in bella-gepuk73-riris npm...

PT-2025-46181

Name of the Vulnerable Software and Affected Versions AWS JDBC Wrapper versions prior to 2.6.5 AWS Go Wrapper versions prior to 2025-10-17 AWS NodeJS Wrapper versions prior to 2.0.1 AWS Python Wrapper versions prior to 1.4.0 AWS PGSQL ODBC driver versions prior to 1.0.1 Description An issue in AW...

MAL-2025-49541 Malicious code in zul-keripik16-apidev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 327007e434ebbc070e76832bdbf0c269d6e92ccc5f8bf95b05b50a1f18327509 The package zul-keripik16-apidev was found to contain malicious code...

Node.js: FS Permissions Bypass

A flaw was discovered in Node.js's Permissions model that allowed attackers to bypass --allow-fs-read and --allow-fs-write restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory could escape the allowed path a...

SUSE SLES12 Security Update : nodejs18 (SUSE-SU-2025:3919-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:3919-1 advisory. - CVE-2025-7783: Switched away from Math.random in boundary values for multipart form-encoded data bsc1246818 Tenable has extracted the preceding...

AZL-69878 CVE-2025-11215 affecting package nodejs for versions less than 24.14.1-3

Off by one error in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Chromium security severity: Medium...

AZL-69905 CVE-2025-11215 affecting package nodejs18 18.20.3-11

Off by one error in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Chromium security severity: Medium...

AZL-69902 CVE-2025-11219 affecting package nodejs18 18.20.3-11

Use after free in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. Chromium security severity: Low...

Security update for nodejs18

This update for nodejs18 fixes the following issues: CVE-2025-7783: Switched away from Math.random in boundary values for multipart form-encoded data bsc1246818 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

SUSE-SU-2025:3919-1 Security update for nodejs18

This update for nodejs18 fixes the following issues: - CVE-2025-7783: Switched away from Math.random in boundary values for multipart form-encoded data bsc1246818...

Exploit for Code Injection in Flowiseai Flowise

CVE-2025-59528.yaml Flowise is a drag & drop user interface to...

Node.js: Timeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilled

A flaw in Node.js's buffer allocation logic was discovered, where buffers allocated with Buffer.alloc and other TypedArray instances like Uint8Array may contain leftover data from previous operations under specific timing conditions...

Malicious code in zohocrm-nodejs-sdk-3.0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8667273dd1820eda9a1a67abda3359d484492251a23ee3bb7acb310721b92ed5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...