MAL-2025-4436 Malicious code in fe-second-party-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2bcbac1a3c8c63cd47005ab85c88ef2933e702844df4a607f5f54157c0a2881b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in fe-second-party-pkg

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

django-crm-admin (1.2.2), pkg-15903 (>=0.1.10, <=0.1.18) potentially affected by CVE-2025-47273 via setuptools (77.0.1)

setuptools PYPI version 77.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - django-crm-admin 1.2.2 - pkg-15903 =0.1.10, =0.1.18 Source cves: CVE-2025-47273 Source advisory: OSV:GHSA-5RJG-FVGR-3XXF...

betfairlightweight (>=0.0.0b4, <=1.8.2), example-pkg-naturalett (>=12.5.0, <=13.4.0) +8 more potentially affected by CVE-2025-47273 via setuptools (39.2.0)

setuptools PYPI version 39.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - betfairlightweight =0.0.0b4, =12.5.0, =0.6.1, =0.2.0, =0.80.8, =0.1.0, =1.0.4, =1.2.3 Source cves: CVE-2025-47273 Source advisory:...

django-crm-admin (1.2.2), pkg-15903 (>=0.1.10, <=0.1.18) potentially affected by CVE-2025-47273 via setuptools (77.0.1)

setuptools PYPI version 77.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - django-crm-admin 1.2.2 - pkg-15903 =0.1.10, =0.1.18 Source cves: CVE-2025-47273 Source advisory: OSV:PYSEC-2025-49...

CVE-2025-43973: Off-by-one Error

An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in which all bytes are available for an RTR message...

CVE-2025-43970: Improper Validation of Specified Quantity in Input

An issue was discovered in GoBGP before 3.35.0. pkg/packet/mrt/mrt.go does not properly check the input length, e.g., by ensuring that there are 12 bytes or 36 bytes depending on the address family...

CVE-2025-43971: Off-by-one Error

An issue was discovered in GoBGP before 3.35.0. pkg/packet/bgp/bgp.go allows attackers to cause a panic via a zero value for softwareVersionLen...

CVE-2025-43971

An issue was discovered in GoBGP before 3.35.0. pkg/packet/bgp/bgp.go allows attackers to cause a panic via a zero value for softwareVersionLen...

CVE-2025-43973

An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in which all bytes are available for an RTR message...

CVE-2025-43972

An issue was discovered in GoBGP before 3.35.0. An attacker can cause a crash in the pkg/packet/bgp/bgp.go flowspec parser by sending fewer than 20 bytes in a certain context...

CVE-2025-43970

An issue was discovered in GoBGP before 3.35.0. pkg/packet/mrt/mrt.go does not properly check the input length, e.g., by ensuring that there are 12 bytes or 36 bytes depending on the address family...

CVE-2025-43972: Improper Validation of Specified Quantity in Input

An issue was discovered in GoBGP before 3.35.0. An attacker can cause a crash in the pkg/packet/bgp/bgp.go flowspec parser by sending fewer than 20 bytes in a certain context...

my-minpy-pkg (>=0.0.0.1, <=0.0.0.2) potentially affected by CVE-2024-8966 via gradio (4.2.0)

gradio PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - my-minpy-pkg =0.0.0.1, =0.0.0.2 Source cves: CVE-2024-8966 Source advisory: OSV:GHSA-5CPQ-9538-JM2J...

my-minpy-pkg (>=0.0.0.1, <=0.0.0.2) potentially affected by CVE-2024-12217 via gradio (4.2.0)

gradio PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - my-minpy-pkg =0.0.0.1, =0.0.0.2 Source cves: CVE-2024-12217 Source advisory: OSV:GHSA-PRPG-P95C-32FV...

CVE-2025-1953

A vulnerability has been found in vLLM AIBrix 0.2.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file pkg/plugins/gateway/prefixcacheindexer/hash.go of the component Prefix Caching. The manipulation leads to insufficiently random values. The...

PT-2025-9703

Name of the Vulnerable Software and Affected Versions vLLM AIBrix version 0.2.0 Description A vulnerability has been found in the Prefix Caching component, specifically in the file pkg/plugins/gateway/prefixcacheindexer/hash.go. This issue leads to insufficiently random values. The complexity of ...

my-minpy-pkg (>=0.0.0.1, <=0.0.0.2) potentially affected by CVE-2025-23042 via gradio (4.2.0)

gradio PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - my-minpy-pkg =0.0.0.1, =0.0.0.2 Source cves: CVE-2025-23042 Source advisory: OSV:PYSEC-2025-118...

Malware in test-evil-pkg-reverse

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2024-50190 ice: fix memleak in ice_init_tx_topology()

In the Linux kernel, the following vulnerability has been resolved: ice: fix memleak in iceinittxtopology Fix leak of the FW blob DDP pkg. Make icecfgtxtopo const-correct, so iceinittxtopology can avoid copying whole FW blob. Copy just the topology section, and only when needed. Reuse the buffer...