1871 matches found
MAL-2026-1059 Malicious code in nuget-task-common (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 711e93cd10681dc29d8c8eea7b459d982383f7b78d0c5fdc73e9398aff953a90 The package nuget-task-common was found to contain malicious code. Source: ossf-package-analysis...
Malicious StripeApi NuGet Package Mimicked Official Library and Stole API Tokens
Cybersecurity researchers have disclosed details of a new malicious package discovered on the NuGet Gallery, impersonating a library from financial services firm Stripe in an attempt to target the financial sector. The package, codenamed StripeApi.Net, attempts to masquerade as Stripe.net, a...
Malicious NuGet Packages Stole ASP.NET Data; npm Package Dropped Malware
Cybersecurity researchers have discovered four malicious NuGet packages that are designed to target ASP.NET web application developers to steal sensitive data. The campaign, discovered by Socket, exfiltrates ASP.NET Identity data, including user accounts, role assignments, and permission mappings...
Malicious Package
Overview IRAOAuth2.0 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...
Malicious Package
Overview SimpleWriter is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
MiracleLinux 8 : dotnet3.1-3.1.424-1.el8.ML.1 (AXSA:2022-3897:12)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-3897:12 advisory. dotnet: Nuget cache poisoning on Linux via world-writable cache directory CVE-2022-41032 Tenable has extracted the preceding description block directly from...
MiracleLinux 8 : dotnet6.0-6.0.118-1.el8.ML.1 (AXSA:2023-6205:16)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-6205:16 advisory. dotnet: .NET Kestrel: Denial of Service processing X509 Certificates CVE-2023-29331 dotnet: vulnerability exists in NuGet where a potential race...
MiracleLinux 9 : dotnet6.0-6.0.106-1.el9.ML.1 (AXSA:2022-4011:15)
The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-4011:15 advisory. dotnet: NuGet Credential leak due to loss of control of third party symbol server domain CVE-2022-30184 Tenable has extracted the preceding description block...
MiracleLinux 9 : dotnet6.0-6.0.110-1.el9.ML.1 (AXSA:2022-4169:19)
The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-4169:19 advisory. dotnet: Nuget cache poisoning on Linux via world-writable cache directory CVE-2022-41032 Tenable has extracted the preceding description block directly from...
MiracleLinux 8 : dotnet7.0-7.0.100-0.4.rc2.el8.ML.1 (AXSA:2023-4584:01)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-4584:01 advisory. dotnet: Nuget cache poisoning on Linux via world-writable cache directory CVE-2022-41032 Tenable has extracted the preceding description block directly from...
MiracleLinux 8 : dotnet6.0-6.0.110-1.el8.ML.1 (AXSA:2022-3895:13)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-3895:13 advisory. dotnet: Nuget cache poisoning on Linux via world-writable cache directory CVE-2022-41032 Tenable has extracted the preceding description block directly from...
MiracleLinux 8 : dotnet6.0-6.0.106-1.el8.ML.1 (AXSA:2022-3758:09)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-3758:09 advisory. dotnet: NuGet Credential leak due to loss of control of third party symbol server domain CVE-2022-30184 Tenable has extracted the preceding description block...
CVE-2026-22685 DevToys Path Traversal (“Zip Slip”) Vulnerability in DevToys Extension Installation
DevToys is a desktop app for developers. In versions from 2.0.0.0 to before 2.0.9.0, a path traversal vulnerability exists in the DevToys extension installation mechanism. When processing extension packages NUPKG archives, DevToys does not sufficiently validate file paths contained within the...
CVE-2026-22685
DevToys (desktop app) has a path traversal vulnerability in its extension installation for versions 2.0.0.0–2.0.8.x, where processing NUPKG archives does not validate file paths, allowing crafted entries like ../../…/target-file to write outside the intended extensions directory. This could overw...
EUVD-2026-1873
DevToys is a desktop app for developers. In versions from 2.0.0.0 to before 2.0.9.0, a path traversal vulnerability exists in the DevToys extension installation mechanism. When processing extension packages NUPKG archives, DevToys does not sufficiently validate file paths contained within the...
CVE-2022-0274
Cross-site Scripting XSS - Stored in NuGet OrchardCore.Application.Cms.Targets prior to 1.2.2...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization in the propagation of token scope for access control within Gitea's package registry. An attacker can gain unauthorized access or perform actions beyond their intended permissions by exploiting improper enforceme...
MAL-2025-192890 Malicious code in sqzrframework480 (NuGet)
--- -= Per source details. Do not edit below this line.=-...
