@codeceptjs/ui (0.7.7), @epicdm/flowstate-shell (>=1.0.1, <=1.0.8) +7 more potentially affected by CVE-2024-46993 via electron (>=28.0.0, <=28.2.3)

electron NPM version =28.0.0, =1.0.1, =9.2.0, =2.0.119, =0.62.0, =0.79.19 - yt-play-cli 0.14.0 Source cves: CVE-2024-46993 Source advisory: OSV:GHSA-6R2X-8PQ8-9489...

@ascua/electron (>=0.4.2, <=0.4.6), @kumologica/kumologica-contrib-amazonbedrock (0.0.1-beta) +3 more potentially affected by CVE-2024-46992 via electron (>=30.0.0, <=30.0.3)

electron NPM version =30.0.0, =0.4.2, =3.6.0-alpha10, =2.0.131, =0.1.1, =0.1.3 Source cves: CVE-2024-46992 Source advisory: OSV:GHSA-XW5Q-G62X-2QJC...

@4via6/relay (>=1.0.0, <=1.1.3), @axonpush/wizard (>=0.0.1, <=0.0.4) +9 more potentially affected by CVE-2025-52882 via @anthropic-ai/claude-code (>=0.2.126, <=1.0.8)

@anthropic-ai/claude-code NPM version =0.2.126, =1.0.0, =0.0.1, =0.0.55, =1.0.0, =0.0.1, =0.0.1, =0.0.1-beta.2, =0.0.1, =0.0.5 - locadex 0.0.2-alpha.1 Source cves: CVE-2025-52882 Source advisory: OSV:GHSA-9F65-56V6-GXW7...

SUSE CVE-2025-5981

Arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR's unpack function for container images. Particularly, when using the CLI flag --remote-image on untrusted container images...

OSV-SCALIBR's Container Image Unpacking Vulnerable to Arbitrary File Write via Path Traversal

Arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR's unpack function for container images. Particularly, when using the CLI flag --remote-image on untrusted container images...

CVE-2025-5981

Arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR's unpack function for container images. Particularly, when using the CLI flag --remote-image on untrusted container images...

CVE-2025-5981 Arbitrary File write in OSV-SCALIBR

Arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR's unpack function for container images. Particularly, when using the CLI flag --remote-image on untrusted container images...

CVE-2025-5981 Arbitrary File write in OSV-SCALIBR

Arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR's unpack function for container images. Particularly, when using the CLI flag --remote-image on untrusted container images...

CVE-2025-5981

OSV-SCALIBR is affected by a path traversal vulnerability in its unpack() function used for container images, exploitable when the CLI flag --remote-image is used on untrusted images. The issue allows arbitrary file write on the host as the OSV-SCALIBR user. Several sources (GitHub commit referen...

CVE-2025-5981 Arbitrary File write in OSV-SCALIBR

Arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR's unpack function for container images. Particularly, when using the CLI flag --remote-image on untrusted container images...

PT-2025-25778 · Unknown · Osv-Scalibr

Name of the Vulnerable Software and Affected Versions: OSV-SCALIBR affected versions not specified Description: The issue allows for arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR's unpack function for container images. Th...

anndata (0.2.0), anndata-hdf5 (>=0.1.0, <=0.1.1) +102 more potentially affected by unknown CVE via arrow2 (>=0.5.3, <=0.17.4)

arrow2 CARGO version =0.5.3, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.1.0, =0.2.1, =0.2.2, =0.4.0, =0.1.0, =0.15.0, =0.16.0 - geoarrow-wasm 0.1.0 - geoarrow2 0.0.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-WV8J-M3HX-924J...

@env-hopper/backend-core (>=2.0.1-alpha-20260224145405, <=2.0.1-alpha.3), @env-hopper/frontend-core (>=2.0.1-alpha, <=2.0.1-alpha.11) +4 more potentially affected by CVE-2025-48054 via radashi (12.5.0-beta.6d5c035)

radashi NPM version 12.5.0-beta.6d5c035 is affected by a known vulnerability. The following packages have a transitive dependency on radashi and may be impacted: - @env-hopper/backend-core =2.0.1-alpha-20260224145405, =2.0.1-alpha, =2.0.1-alpha-20260224145405, =0.0.1, =0.0.1, =0.0.1,...

3llm (0.0.1), @abuaiman/abujunainah (1.1.4) +422 more potentially affected by CVE-2025-32421 via next (>=15.0.0, <=15.1.5)

next NPM version =15.0.0, =0.0.3-alpha-20241021184442-252a149a89c221b28ae459807869535922e67185, =1.0.19, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.1.0, =0.0.4, =0.0.8 - @akukoio/components 0.0.3 and more Source cves: CVE-2025-32421 Source advisory: OSV:GHSA-QPJV-V59X-3QC4...

OSV-2025-326 Heap-use-after-free in __JS_FreeValueRT

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=415361008 Crash type: Heap-use-after-free WRITE 8 Crash state: JSFreeValueRT JSCallInternal JSEvalFunctionInternal...

audio-video-metadata (>=0.1.0, <=0.1.7), fselect (>=0.3.2, <=0.8.11) +4 more potentially affected by unknown CVE via mp3-metadata (>=0.1.1, <=0.3.4)

mp3-metadata CARGO version =0.1.1, =0.1.0, =0.3.2, =0.1.2, =0.1.0, =0.2.2 Source cves: unknown CVE Source advisory: OSV:GHSA-927Q-G9W9-PM54...

a3mo_lib (>=0.1.0, <=0.1.1), abra (0.0.1) +4423 more potentially affected by unknown CVE via rustc-serialize (>=0.1.5, <=0.3.25)

rustc-serialize CARGO version =0.1.5, =0.1.0, =0.1.7, =0.2.0-beta.4, =0.0.6, =0.1.0, =0.2.1, =0.1.4, =0.1.1, =0.1.0, =0.9.0, =0.1.0, =0.3.3, =0.5.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0025...

@compas/server (>=0.0.219, <=0.17.0), @eamic/server (>=1.0.1, <=1.0.3) +23 more potentially affected by CVE-2025-46653 via formidable (>=2.1.1, <=2.1.2)

formidable NPM version =2.1.1, =0.0.219, =1.0.1, =3.0.0-alpha.21, =1.0.10, =1.8.8, =0.141.0, =0.0.219, =1.13.0, =1.0.9, =1.3.15, =0.1.0, =0.21.7, =0.1.0, =1.1.0 and more Source cves: CVE-2025-46653 Source advisory: OSV:GHSA-75V8-2H7P-7M2M...

aabb_physics (>=0.1.0, <=0.1.1), acolor (>=0.0.2, <=0.0.11) +117 more potentially affected by unknown CVE via macroquad (>=0.2.9, <=0.4.16)

macroquad CARGO version =0.2.9, =0.1.0, =0.0.2, =0.1.0, =0.1.0, =0.1.0, =0.0.4, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.3 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0035...

A Time Series Analysis of Malware Uploads to Programming Language Ecosystems

Software ecosystems built around programming languages have greatly facilitated software development. At the same time, their security has increasingly been acknowledged as a problem. To this end, the paper examines the previously overlooked longitudinal aspects of software ecosystem security,...