Malicious code in gammarayburst-local-nova-graviton (npm)

The package gammarayburst-local-nova-graviton was found to contain malicious code...

MAL-2025-31477 Malicious code in radiance-iggjj-1ty6g-nova-project (npm)

The package radiance-iggjj-1ty6g-nova-project was found to contain malicious code...

MAL-2025-39023 Malicious code in webpack-jupiter-nova-graphql (npm)

The package webpack-jupiter-nova-graphql was found to contain malicious code...

MAL-2025-27749 Malicious code in nova-evtdo-km8su-pebble-project (npm)

The package nova-evtdo-km8su-pebble-project was found to contain malicious code...

MAL-2025-27744 Malicious code in nova-4vq18-qsa33-flame-project (npm)

The package nova-4vq18-qsa33-flame-project was found to contain malicious code...

Malicious code in nova-altair-phenomic-gemini (npm)

The package nova-altair-phenomic-gemini was found to contain malicious code...

Malicious code in nova-carina-prettier-plugin-markdown-triton (npm)

The package nova-carina-prettier-plugin-markdown-triton was found to contain malicious code...

Malicious code in nova-zooarchaeology-cryovolcano-ariel (npm)

The package nova-zooarchaeology-cryovolcano-ariel was found to contain malicious code...

Malicious code in nova-state (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-6850 Malicious code in nova-state (npm)

The package communicates with a domain associated with malicious activity...

Fedora 41 : cloud-init (2025-58f05c43ae)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-58f05c43ae advisory. Backport fixes for CVE-2024-6174 and CVE-2024-11584 - cloud-init included the systemd socket unit cloud-init-hotplugd.socket with default SocketMode...

MAL-2025-6744 Malicious code in nova-ssr-utils (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

Malicious code in nova-ssr-utils (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

MAL-2025-6743 Malicious code in nova-node-utils (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

Malicious code in nova-node-utils (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

CVE-2025-54082

marshmallow-packages/nova-tiptap is a rich text editor for Laravel Nova based on tiptap. Prior to 5.7.0, a vulnerability was discovered in the marshmallow-packages/nova-tiptap Laravel Nova package that allows unauthenticated users to upload arbitrary files to any Laravel disk configured in the...

GHSA-96C2-H667-9FXP nova-tiptap has Unauthenticated Arbitrary File Upload Vulnerability

A vulnerability was discovered in the marshmallow-packages/nova-tiptap Laravel Nova package that allows unauthenticated users to upload arbitrary files to any Laravel disk configured in the application. The vulnerability is due to: • Missing authentication middleware Nova and Nova.Auth on the...

CVE-2025-54082

marshmallow-packages/nova-tiptap is a rich text editor for Laravel Nova based on tiptap. Prior to 5.7.0, a vulnerability was discovered in the marshmallow-packages/nova-tiptap Laravel Nova package that allows unauthenticated users to upload arbitrary files to any Laravel disk configured in the...

Arbitrary File Upload

Overview marshmallow/nova-tiptap is a Laravel Nova tiptap editor field. Affected versions of this package are vulnerable to Arbitrary File Upload via the /nova-tiptap/api/file endpoint, which lacks authentication and file validation. An attacker can upload arbitrary files, including executable or...

CVE-2025-54082

marshmallow-packages/nova-tiptap is a rich text editor for Laravel Nova based on tiptap. Prior to 5.7.0, a vulnerability was discovered in the marshmallow-packages/nova-tiptap Laravel Nova package that allows unauthenticated users to upload arbitrary files to any Laravel disk configured in the...