EUVD-2025-90449

Malicious code in lina-bubur41-miaww npm...

EUVD-2025-89137

Malicious code in riana-taiwan29-miaww npm...

able_catfish_z3n (=3.2.4), absolute_eagle_z3n (=3.4.1) +391 more potentially affected by unknown CVE via rudiscammer (>=0.1.0 <=4.2.5)

rudiscammer NPM version =0.1.0, =4.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on rudiscammer and may be impacted: - ablecatfishz3n =3.2.4 - absoluteeaglez3n =3.4.1 - abundantparrotz3n =4.2.3 - academiclimpetz3n =3.2.4 - acceptableemuz3n =3.1.4 -...

12boowjljk-notthedevs (=1.6.9), ahahscroot (=1.0.1) +14 more potentially affected by unknown CVE via 666-tea (=1.1.4)

666-tea NPM version =1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on 666-tea and may be impacted: - 12boowjljk-notthedevs =1.6.9 - ahahscroot =1.0.1 - bacoritul =1.0.1 - basuki =1.0.0 - df6fqftol9-notthedevs =1.6.9 - forilcuy =1.0.1 - gasmbut...

EUVD-2025-54117

Malicious code in glamorous-silver-yak npm...

EUVD-2025-50963

Malicious code in xerothermic-coffee-gorilla npm...

KLA90059 Multiple vulnerability in Microsoft Open Source Software

A remote code execution vulnerability was found in Microsoft Open Source Software. Malicious users can exploit this vulnerability to execute arbitrary code, bypass security restrictions. Original advisories CVE-2025-62220 Related products Microsoft-Windows CVE list CVE-2025-62220 critical Solutio...

[SECURITY] Fedora 43 Update: chromium-142.0.7444.134-1.fc43

Chromium is an open-source web browser, powered by WebKit Blink...

Falco 0.42.1

Sysdig Falco is a behavioral activity monitoring agent that is open source and comes with native support for containers. Falco lets you define highly granular rules to check for activities involving file and network activity, process execution, IPC, and much more, using a flexible syntax. Falco...

[SECURITY] Fedora 42 Update: singularity-ce-4.3.4-1.fc42

SingularityCE is the Community Edition of Singularity, an open source container platform designed to be simple, fast, and secure...

[SECURITY] Fedora 43 Update: singularity-ce-4.3.4-1.fc43

SingularityCE is the Community Edition of Singularity, an open source container platform designed to be simple, fast, and secure...

OSV-2025-884 Heap-use-after-free in JS_DefineProperty

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=458199402 Crash type: Heap-use-after-free READ 8 Crash state: JSDefineProperty buildbacktrace JSCallInternal...

Cryptographic Binding Should Not Be Optional: A Formal-Methods Analysis of FIDO UAF Channel Binding

As a case study in cryptographic binding, we present a formal-methods analysis of the cryptographic channel binding mechanisms in the Fast IDentity Online FIDO Universal Authentication Framework UAF authentication protocol, which seeks to reduce the use of traditional passwords in favor of...

EUVD-2025-38341

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.4.0 through 2.48.1, a malicious CVAT user with at least the User global role may create files in the root of the mounted file share, or overwrite existing files. If no file share is mounted, the...

CVE-2025-63585

OSSN Open Source Social Network 8.6 is vulnerable to SQL Injection in /action/rtcomments/status via the timestamp parameter...

[SECURITY] Fedora 41 Update: chromium-142.0.7444.59-1.fc41

Chromium is an open-source web browser, powered by WebKit Blink...

[SECURITY] Fedora 42 Update: chromium-142.0.7444.59-1.fc42

Chromium is an open-source web browser, powered by WebKit Blink...

Conda Constructor 安全漏洞

Conda Constructor is a Conda open source tool for creating installers from conda packages. A security vulnerability exists in Conda Constructor 3.12.2 and earlier versions, which stems from the installation directory inheriting parent directory permissions, which could lead to modification...

CVE-2024-25621

containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an overly broad default permission vulnerability. Directory paths /var/lib/containerd,...

CVE-2025-64163

DataEase is an open source data visualization analysis tool. In versions 2.10.14 and below, the vendor added a blacklist to filter ldap:// and ldaps://. However, omission of protection for the dns:// protocol results in an SSRF vulnerability. This issue is fixed in version 2.10.15...