MAL-2025-27750 Malicious code in nova-interstellarmedium-perturbation-palynology (npm)

The package nova-interstellarmedium-perturbation-palynology was found to contain malicious code...

MAL-2025-27680 Malicious code in nodejs-greatfilter-nova-xenobiology (npm)

The package nodejs-greatfilter-nova-xenobiology was found to contain malicious code...

MAL-2025-27755 Malicious code in nova-sqlite-jovian-development (npm)

The package nova-sqlite-jovian-development was found to contain malicious code...

MAL-2025-27756 Malicious code in nova-uoho4-jtz6m-yarn-project (npm)

The package nova-uoho4-jtz6m-yarn-project was found to contain malicious code...

MAL-2025-17680 Malicious code in cressida-geodynamo-nova-spica (npm)

The package cressida-geodynamo-nova-spica was found to contain malicious code...

MAL-2025-14783 Malicious code in archaeogenetics-nova-centauri-tool (npm)

The package archaeogenetics-nova-centauri-tool was found to contain malicious code...

MAL-2025-27745 Malicious code in nova-7jcu0-dknw0-nymph-project (npm)

The package nova-7jcu0-dknw0-nymph-project was found to contain malicious code...

MAL-2025-33087 Malicious code in shelljs-uglify-js-nova-xml (npm)

The package shelljs-uglify-js-nova-xml was found to contain malicious code...

Malicious code in nova-state (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-6850 Malicious code in nova-state (npm)

The package communicates with a domain associated with malicious activity...

Fedora 41 : cloud-init (2025-58f05c43ae)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-58f05c43ae advisory. Backport fixes for CVE-2024-6174 and CVE-2024-11584 - cloud-init included the systemd socket unit cloud-init-hotplugd.socket with default SocketMode...

Malicious code in nova-ssr-utils (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

MAL-2025-6744 Malicious code in nova-ssr-utils (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

MAL-2025-6743 Malicious code in nova-node-utils (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

Malicious code in nova-node-utils (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

CVE-2025-54082

marshmallow-packages/nova-tiptap is a rich text editor for Laravel Nova based on tiptap. Prior to 5.7.0, a vulnerability was discovered in the marshmallow-packages/nova-tiptap Laravel Nova package that allows unauthenticated users to upload arbitrary files to any Laravel disk configured in the...

GHSA-96C2-H667-9FXP nova-tiptap has Unauthenticated Arbitrary File Upload Vulnerability

A vulnerability was discovered in the marshmallow-packages/nova-tiptap Laravel Nova package that allows unauthenticated users to upload arbitrary files to any Laravel disk configured in the application. The vulnerability is due to: • Missing authentication middleware Nova and Nova.Auth on the...

CVE-2025-54082

marshmallow-packages/nova-tiptap is a rich text editor for Laravel Nova based on tiptap. Prior to 5.7.0, a vulnerability was discovered in the marshmallow-packages/nova-tiptap Laravel Nova package that allows unauthenticated users to upload arbitrary files to any Laravel disk configured in the...

Arbitrary File Upload

Overview marshmallow/nova-tiptap is a Laravel Nova tiptap editor field. Affected versions of this package are vulnerable to Arbitrary File Upload via the /nova-tiptap/api/file endpoint, which lacks authentication and file validation. An attacker can upload arbitrary files, including executable or...

CVE-2025-54082 nova-tiptap has an Unauthenticated Arbitrary File Upload Vulnerability

marshmallow-packages/nova-tiptap is a rich text editor for Laravel Nova based on tiptap. Prior to 5.7.0, a vulnerability was discovered in the marshmallow-packages/nova-tiptap Laravel Nova package that allows unauthenticated users to upload arbitrary files to any Laravel disk configured in the...