Malicious code in json-schema-to-typescript-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 148a68690ce752d3b4d67269d4cdd05066913f5abbc344c7f7bf9ac550af794b The package json-schema-to-typescript-example was found to contain malicious code. Source: ossf-package-analysis...

AgentCyTE: Leveraging Agentic AI to Generate Cybersecurity Training and Experimentation Scenarios

Designing realistic and adaptive networked threat scenarios remains a core challenge in cybersecurity research and training, still requiring substantial manual effort. While large language models LLMs show promise for automated synthesis, unconstrained generation often yields configurations that...

pgcodekeeper security vulnerability

pgCodeKeeper is an open source Eclipse plugin for database schema management from pgCodeKeeper. A security vulnerability exists in pgcodekeeper version 10.12.0, which stems from storing passwords and usernames in clear text and could lead to the disclosure of sensitive information...

CLSA-2025-1761261543 Fix CVE(s): CVE-2024-56171

SECURITY UPDATE: use-after-free vulnerability in XML schema processing - debian/patches/CVE-2024-56171.patch: Fix use-after-free after xmlSchemaItemListAdd in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables - CVE-2024-56171...

TencentOS Server 2: libxml2 (TSSA-2025:0787)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0787 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

CVE-2025-56450

Log2Space Subscriber Management Software 1.1 is vulnerable to an unauthenticated SQL injection vulnerability in the /l2s/api/selfcareLeadHistory endpoint. The root cause is a failure to sanitize the lead_id parameter, which allows a remote attacker to send a specially crafted POST request to exec...

vulnlog-poc

Vulnlog Proof of Concepts YAML and JSON Schema PoC - y...

BreakFun: Jailbreaking LLMs Via Schema Exploitation

The proficiency of Large Language Models LLMs in processing structured data and adhering to syntactic rules is a capability that drives their widespread adoption but also makes them paradoxically vulnerable. In this paper, we investigate this vulnerability through BreakFun, a jailbreak methodolog...

JLSEC-2025-86 libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables...

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be...

PT-2025-46065

In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used...

Angular SSR has a Server-Side Request Forgery (SSRF) flaw

Impact The vulnerability is a Server-Side Request Forgery SSRF flaw within the URL resolution mechanism of Angular's Server-Side Rendering package @angular/ssr. The function createRequestUrl uses the native URL constructor. When an incoming request path e.g., originalUrl or url begins with a doub...

CVE-2025-54858

When a BIG-IP Advanced WAF or BIG-IP ASM Security Policy is configured with a JSON content profile that has a malformed JSON schema, and the security policy is applied to a virtual server, undisclosed requests can cause the bd process to terminate. Note: Software versions which have reached End o...

CVE-2025-62427: Server-Side Request Forgery (SSRF)

The Angular SSR is a server-rise rendering tool for Angular applications. The vulnerability is a Server-Side Request Forgery SSRF flaw within the URL resolution mechanism of Angular's Server-Side Rendering package @angular/ssr before 19.2.18, 20.3.6, and 21.0.0-next.8. The function createRequestU...

EUVD-2025-34632

When a BIG-IP Advanced WAF or BIG-IP ASM Security Policy is configured with a JSON content profile that has a malformed JSON schema, and the security policy is applied to a virtual server, undisclosed requests can cause the bd process to terminate. Note: Software versions which have reached End o...

CVE-2025-54858

When a BIG-IP Advanced WAF or BIG-IP ASM Security Policy is configured with a JSON content profile that has a malformed JSON schema, and the security policy is applied to a virtual server, undisclosed requests can cause the bd process to terminate. Note: Software versions which have reached End o...

CVE-2025-54858

When a BIG-IP Advanced WAF or BIG-IP ASM Security Policy is configured with a JSON content profile that has a malformed JSON schema, and the security policy is applied to a virtual server, undisclosed requests can cause the bd process to terminate. Note: Software versions which have reached End o...

CVE-2025-54858 BIG-IP Advanced WAF and ASM vulnerability

When a BIG-IP Advanced WAF or BIG-IP ASM Security Policy is configured with a JSON content profile that has a malformed JSON schema, and the security policy is applied to a virtual server, undisclosed requests can cause the bd process to terminate. Note: Software versions which have reached End o...

CVE-2025-54858

CVE-2025-54858 affects BIG-IP Advanced WAF/ASM where a malformed JSON schema in a JSON content profile can cause the bd process to terminate on a configured virtual server, triggering DoS. Affected BIG-IP branches include BIG-IP Advanced WAF/ASM (16.x, 17.x) with fixes introduced in 17.5.1.3 and ...

CVE-2025-54858 BIG-IP Advanced WAF and ASM vulnerability

When a BIG-IP Advanced WAF or BIG-IP ASM Security Policy is configured with a JSON content profile that has a malformed JSON schema, and the security policy is applied to a virtual server, undisclosed requests can cause the bd process to terminate. Note: Software versions which have reached End o...

azureml-webservice-schema (>=0.1.57, <=1.0.33), mmtfpyspark (0.2.7) +1 more potentially affected by CVE-2025-55039 via pyspark (2.3.1)

pyspark PYPI version 2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - azureml-webservice-schema =0.1.57, =2.0.3, =2.1.1 Source cves: CVE-2025-55039 Source advisory: OSV:GHSA-6P6V-M64V-JX8Q...