CVE-2025-26625

A flaw was found in Git LFS. Running git lfs checkout and git lfs pull in a specially crafted repository, specifically with symbolic or hard links tracked by Git LFS and pointing to files outside the working tree or in a bare repository, can cause Git LFS to write to arbitrary file system locatio...

UBUNTU-CVE-2025-26625

Git LFS is a Git extension for versioning large files. In Git LFS versions 0.5.2 through 3.7.0, when populating a Git repository's working tree with the contents of Git LFS objects, certain Git LFS commands may write to files visible outside the current Git working tree if symbolic or hard links...

Malicious code in usage-tracker-secured (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f1b7a443b3167fff4524481ab0e2a965023fdb4379674c580d905e30aacc7f70 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48441 Malicious code in webpack-loadcss (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d590321a232bcb801aa8ef974d8eca8774570f32d2f87e026c6694aff0a6bd45 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48428 Malicious code in package-f (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1deec43d176fc23dbd4cb44b3e1d4e90821cb98e441004f83c872d49ca281ac9 Any computer that has this package installed or running should be considered...

Malicious code in cryptocom-corp-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1239238ee10c3bbee24c5972edf8784d63ed06bba75e7ff07eaf23dde788c82f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cryptocom-private-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1c127979ce2c818c0baa9e2f6212dc73783686c797a35b3e63148a4815325de5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cryptocom-internal-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f2f5ee433ed448881b851d37d04551c6efa2158704ade3830378ef1b9587c1c2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Argo Workflow has a Zipslip Vulnerability

Vulnerability Description Vulnerability Overview 1. During the artifact extraction process, the unpack function extracts the compressed file to a temporary directory /etc.tmpdir and then attempts to move its contents to /etc using the rename system call, 2. However, since /etc is an already...

EUVD-2025-34143

In Eclipse ThreadX before version 6.4.3, an attacker can cause a denial of service crash by providing a pointer to a reserved or unmapped memory region. Vulnerable system calls had a check of pointers, but that check wasn't verifying whether the pointer is outside the module memory region...

PT-2025-41937

Name of the Vulnerable Software and Affected Versions Argo Workflows versions prior to 3.6.12 Argo Workflows versions 3.7.0 through 3.7.2 Description Argo Workflows, a container-native workflow engine for Kubernetes, contains a Zip Slip path traversal issue during artifact extraction. The...

Malicious code in scr-cloud-project (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c714f60369d28f727a675effd525b4208077e225e46026b537d7606d48708a9a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48336 Malicious code in mad-1.2.8.2.2.8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f458f275324cf68bed67b3ae284456b3688dfd9634450c5a03f39552352ea625 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mad-1.2.5.2.2.8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b2a7a2c9ba3ee455fb1327bbf9794e2ff26b21cee0dd6d1feef0cb6b3d57da55 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48338 Malicious code in mad-4.2.1.2.2.8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 442b99f653fadc968f55dae809fcdc5561c7d6a38400322dd0b98b9c89cfc86a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mad-8.2.1.2.2.8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f1fd4259c0de84b69ec4997af8ecf958bef9b6dd06c7ed580c56cfdb9baedc2b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Huawei EulerOS: Security Advisory for python3 (EulerOS-SA-2025-2210)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-39664

Insufficient escaping in the report scheduler within Checkmk 2.4.0p13, 2.3.0p38, 2.2.0p46 and 2.1.0 EOL allows authenticated attackers to define the storage location of report file pairs beyond their intended root directory...

EUVD-2025-33657

drupal-pattern-lab/unified-twig-extensions is vulnerable to XXS...

drupal-pattern-lab/unified-twig-extensions is vulnerable to XXS

Versions of the package drupal-pattern-lab/unified-twig-extensions from 0.0.0 are vulnerable to Cross-site Scripting XSS due to insufficient filtering of data. Note: This is exploitable only if the code is executed outside of Drupal; the function is intended to be shared between Drupal and Patter...