Malicious code in meta-compile-shell-quick-resolve (npm)

The package meta-compile-shell-quick-resolve was found to contain malicious code...

MAL-2025-32769 Malicious code in scale-cache-resolve-file-wind (npm)

The package scale-cache-resolve-file-wind was found to contain malicious code...

MAL-2025-19794 Malicious code in error-float-report-resolve-sigma (npm)

The package error-float-report-resolve-sigma was found to contain malicious code...

MAL-2025-23282 Malicious code in interpret-rain-delta-sed-resolve (npm)

The package interpret-rain-delta-sed-resolve was found to contain malicious code...

MAL-2025-15342 Malicious code in balance-rho-resolve-alpha-uglify (npm)

The package balance-rho-resolve-alpha-uglify was found to contain malicious code...

MAL-2025-20063 Malicious code in export-double-cache-benchmark-resolve (npm)

The package export-double-cache-benchmark-resolve was found to contain malicious code...

Malicious code in export-double-cache-benchmark-resolve (npm)

The package export-double-cache-benchmark-resolve was found to contain malicious code...

MAL-2025-17448 Malicious code in compile-dog-resolve-java-slow (npm)

The package compile-dog-resolve-java-slow was found to contain malicious code...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the PdfType::resolve which evaluates indirect and direct object references until a final value is reached. An attacker can cause memory exhaustion and crash the server by uploadin...

apache-commons-vfs: Apache Commons VFS: Possible path traversal issue when using NameScope.DESCENDENT

A flaw was found in Apache Commons VFS. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file". However, when the path contains...

EAP: wildfly-elytron has a SSRF security issue

A flaw was found in JwtValidator.resolvePublicKey in JBoss EAP, where the validator checks jku and sends a HTTP request. During this process, no whitelisting or other filtering behavior is performed on the destination URL address, which may result in a server-side request forgery SSRF vulnerabili...

EAP: wildfly-elytron has a SSRF security issue

A flaw was found in JwtValidator.resolvePublicKey in JBoss EAP, where the validator checks jku and sends a HTTP request. During this process, no whitelisting or other filtering behavior is performed on the destination URL address, which may result in a server-side request forgery SSRF vulnerabili...

Malicious code in jridgewell-resolve-uri-latest (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4ebc214d374220844dddff1ed8dc339282cd98387925c0d108222a3dc578d430 Any computer that has this package installed or running should be considered...

CVE-2022-50212

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: do not allow CHAINID to refer to another table When doing lookups for chains on the same batch by using its ID, a chain from a different table can be used. If a rule is added to a table but refers to a chain ...

Advisory ROSA-SA-2025-2886

Software: freetype 2.9.1 OS: ROSA Virtualization 3.0 packageevrstring: freetype-2.9.1-10.rv30 CVE-ID: CVE-2025-27363 BDU-ID: 2025-02719 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the FreeType font rasterization library is related to reading beyond buffer boundaries in memory. Exploitation of th...

Improper Authorization

Overview accelbyte-py-sdk is an AccelByte Python SDK Affected versions of this package are vulnerable to Improper Authorization via the resolve function in the protohttprequest.py, which accepts COOKIEAUTH and bypasses additional Basic or Bearer auth requirements. Remediation Upgrade...

CVE-2025-4081

Use of entitlement "com.apple.security.cs.disable-library-validation" and lack of launch and library load constraints allows to substitute a legitimate dylib with malicious one. A local attacker with unprivileged access can execute the application with altered dynamic library successfully bypassi...

CVE-2025-4081

Use of entitlement "com.apple.security.cs.disable-library-validation" and lack of launch and library load constraints allows to substitute a legitimate dylib with malicious one. A local attacker with unprivileged access can execute the application with altered dynamic library successfully bypassi...

CVE-2025-4081 TCC Bypass via Dylib Substitution in DaVinci Resolve

Use of entitlement "com.apple.security.cs.disable-library-validation" and lack of launch and library load constraints allows to substitute a legitimate dylib with malicious one. A local attacker with unprivileged access can execute the application with altered dynamic library successfully bypassi...

CVE-2025-4081

The CVE-2025-4081 entry concerns a TCC bypass in DaVinci Resolve for macOS caused by using the entitlement com.apple.security.cs.disable-library-validation and missing launch/library-load constraints, enabling local unprivileged attackers to substitute a legitimate dylib with a malicious one. The...