MAL-2025-46922 Malicious code in spamurai-dev-kit (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6809fd87c593e76bcb0bd4a719cab9e51e2d3b617f9a172d0a8a2f68a09474e7 The OpenSSF Package Analysis project identified 'spamurai-dev-kit' @ 3.0.1 rubygems as malicious. It is considered malicious because: - The...

MAL-2025-41815 Malicious code in teshjsss (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b7b15a769724686fbeb9dc5078008a1cd05c1c14a8b9f6de5ec415c369fbaabf The OpenSSF Package Analysis project identified 'teshjsss' @ 1337.0.0 npm as malicious. It is considered malicious because: - The package...

Use of Hard-coded Cryptographic Key

Overview Affected versions of this package are vulnerable to Use of Hard-coded Cryptographic Key in the form of AuthSecretKey, StateSecretKey, and OAuthTokenSecretKey as defined in aes.go, which are used when generating the callback URL for OAuth authentication. Remediation Upgrade...

Malicious code in @flight-common/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 10b5cb816f030297707c6e9ae79f7916de698fd58c8b068b18ef716c7425240b The OpenSSF Package Analysis project identified '@flight-common/components' @ 1.2.9213 npm as malicious. It is considered malicious because: - T...

libmozjs-128-0-128.14.0-1.1 on GA media (moderate)

libmozjs-128-0-128.14.0-1.1 on GA media Announcement ID: openSUSE-SU-2025:15494-1 Rating: moderate Cross-References: CVE-2025-9179 CVE-2025-9180 CVE-2025-9181 CVE-2025-9185 CVSS scores: CVE-2025-9179 SUSE : 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2025-9180 SUSE : 8.1...

Oracle Linux 8 : python3.12 (ELSA-2025-14546)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-14546 advisory. 3.12.11-2 - Security fix for CVE-2025-8194 Resolves: RHEL-106343 Tenable has extracted the preceding description block directly from the Oracle Linux security...

MAL-2025-41318 Malicious code in rehype-headerless-table-plugin (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5f663df30b939e46c2ebd664fc1dae15c177895427b67b8b2b3d646b000bc64f The OpenSSF Package Analysis project identified...

MAL-2025-41290 Malicious code in heft-example-lifecycle-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fce75dcff1360927b5ed18017c2b53424afe03e0c1f53f13505883d9fe23fd55 The OpenSSF Package Analysis project identified 'heft-example-lifecycle-plugin' @ 99.0.9 npm as malicious. It is considered malicious because: -...

MAL-2025-41265 Malicious code in @google_cloud/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77d1d3e3759d05fa05f2d625c645f9ccca58c49fbedc0eb52e1ae34ca2a4d0c0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ruby3.4-rubygem-activerecord-8.0-8.0.1-2.1 on GA media (moderate)

ruby3.4-rubygem-activerecord-8.0-8.0.1-2.1 on GA media Announcement ID: openSUSE-SU-2025:15480-1 Rating: moderate Cross-References: CVE-2025-55193 CVSS scores: CVE-2025-55193 SUSE : 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVE-2025-55193 SUSE : 5.3...

Malicious code in @navancorp/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c1de6ab614103c47766130fafe2ddecb44f6c2cef32971d3da5418641756227 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-41254 Malicious code in orion-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d017f02da39bfb33285066e5d65476f32d57195efe73652d4659863fe7b0367c The OpenSSF Package Analysis project identified 'orion-ui' @ 9.2.3 npm as malicious. It is considered malicious because: - The package...

MAL-2025-6886 Malicious code in solana-spl-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis abc65f4de1b50248d903c79cb67ac016c8da464314e5830c70dbe0a1140503a9 The OpenSSF Package Analysis project identified 'solana-spl-sdk' @ 0.1.1 npm as malicious. It is considered malicious because: - The package...

MAL-2025-6867 Malicious code in dependerable (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f710204dca1899f1d3c1289dee4a05e791bfd14fdbe3678e52d4caa62869d816 The OpenSSF Package Analysis project identified 'dependerable' @ 99.0.0 npm as malicious. It is considered malicious because: - The package...

Ubuntu: Security Advisory (USN-7688-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OPENSUSE-SU-2025:15433-1 framework-inputmodule-control-0.2.0-3.1 on GA media

These are all security issues fixed in the framework-inputmodule-control-0.2.0-3.1 package on the GA media of openSUSE Tumbleweed...

[SECURITY] [DLA 4269-1] ca-certificates-java bugfix update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4269-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucariès August 11, 2025 https://wiki.debian.org/LTS -...

MAL-2025-6814 Malicious code in horizon-ui-ng (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 05025cfe461de95f60e8359c367b851181a07564256a7ce672e7c313007d0f87 The OpenSSF Package Analysis project identified 'horizon-ui-ng' @...

CVE-2025-38422 affecting package kernel for versions less than 6.6.96.1-1

CVE-2025-38422 affecting package kernel for versions less than 6.6.96.1-1. An upgraded version of the package is available that resolves this issue...

SUSE: Security Advisory (SUSE-SU-2025:02350-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...