MAL-2025-190637 Malicious code in @asyncapi/generator-react-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b0dadd48783af136a9dcf3f65cf9f24675841f02c7d1a5b6dc60709b392bf98 The package @asyncapi/generator-react-sdk was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-198634

Malicious code in @asyncapi/generator-react-sdk npm...

Malicious code in @asyncapi/generator-react-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b0dadd48783af136a9dcf3f65cf9f24675841f02c7d1a5b6dc60709b392bf98 The package @asyncapi/generator-react-sdk was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-198646

Malicious code in @zapier/zapier-sdk npm...

Tuya多款产品 安全漏洞

Tuya Android SDK and others are products of Tuya China.Tuya Android SDK is a software development kit.Tuya iOS SDK is a software development kit.Tuya Smart App is a smart app. A security vulnerability exists in several Tuya products, which stems from an unvalidated state parameter in the OAuth...

CVE-2025-56400

Cross-Site Request Forgery CSRF vulnerability in the OAuth implementation of the Tuya SDK 6.5.0 for Android and iOS, affects the Tuya Smart and Smartlife mobile applications, as well as other third-party applications that integrate the SDK, allows an attacker to link their own Amazon Alexa accoun...

CVE-2025-64655 Dynamics OmniChannel SDK Storage Containers Elevation of Privilege Vulnerability

...

KLA90451 PE vulnerability in Microsoft Dynamics

An elevation of privilege vulnerability was found in Microsoft Dynamics. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2025-64655 Related products Dynamics-OmniChannel-SDK CVE list CVE-2025-64655 critical Solution Install necessary updates from the KB...

ai-sdk-provider-claude-code (>=0.2.0, <=1.0.0-beta.1), locadex (0.0.2-alpha.1) potentially affected by CVE-2025-65099 via @anthropic-ai/claude-code (>=1.0.8, <=1.0.24)

@anthropic-ai/claude-code NPM version =1.0.8, =0.2.0, =1.0.0-beta.1 - locadex 0.0.2-alpha.1 Source cves: CVE-2025-65099 Source advisory: OSV:GHSA-5HHX-V7F6-X7GV...

ai-sdk-provider-claude-code (>=0.2.0, <=1.0.0-beta.1), locadex (0.0.2-alpha.1) potentially affected by CVE-2025-65099 via @anthropic-ai/claude-code (>=1.0.8, <=1.0.24)

@anthropic-ai/claude-code NPM version =1.0.8, =0.2.0, =1.0.0-beta.1 - locadex 0.0.2-alpha.1 Source cves: CVE-2025-65099 Source advisory: SNYK:JS-ANTHROPICAICLAUDECODE-14073012...

GO-2025-4112 Evervault Go SDK: Incomplete PCR Validation in Enclave Attestation for non-Evervault hosted Enclaves in github.com/evervault/evervault-go

Evervault Go SDK: Incomplete PCR Validation in Enclave Attestation for non-Evervault hosted Enclaves in github.com/evervault/evervault-go...

CVE-2025-4321

In a Bluetooth device, using RS9116-WiseConnect SDK experiences a Denial of Service, if it receives malformed L2CAP packets, only hard reset will bring the device to normal operation...

EUVD-2025-197801

In a Bluetooth device, using RS9116-WiseConnect SDK experiences a Denial of Service, if it receives malformed L2CAP packets, only hard reset will bring the device to normal operation...

Adobe Pass Authentication Android SDK Incorrect Authorization Vulnerability

Adobe Pass Authentication Android SDK is a Java library for Android applications from the American company Audobee Adobe. The Adobe Pass Authentication Android SDK suffers from an incorrect authorization vulnerability that can be exploited by attackers to bypass security measures and gain...

Cloudflare Public Bug Bounty: AI Playground XSS to steal user-chat messages and access to connected MCP Server

A reflected XSS vulnerability was discovered in the AI Playground OAuth handler due to unescaped interpolation of the errordescription parameter into a script tag. The issue has been patched, and users of the open-source Agents SDK should upgrade to v0.3.10...

CVE-2025-64186 Evervault Go SDK: Incomplete PCR Validation in Enclave Attestation for non-Evervault hosted Enclaves

Evervault is a payment security solution. A vulnerability was identified in the evervault-go SDK’s attestation verification logic in versions of evervault-go prior to 1.3.2 that may allow incomplete documents to pass validation. This may cause the client to trust an enclave operator that does not...

CVE-2025-64186 Evervault Go SDK: Incomplete PCR Validation in Enclave Attestation for non-Evervault hosted Enclaves

Evervault is a payment security solution. A vulnerability was identified in the evervault-go SDK’s attestation verification logic in versions of evervault-go prior to 1.3.2 that may allow incomplete documents to pass validation. This may cause the client to trust an enclave operator that does not...

Evervault Go SDK 数据伪造问题漏洞

Evervault Go SDK is an open source development toolkit from Evervault. A Data Forgery Issue vulnerability exists in Evervault Go SDK versions prior to 1.3.2, which stems from incomplete validation logic that could lead to trusting an enclave operator that does not meet integrity guarantees...

CVE-2025-63289

Sogexia Android App Compile Affected SDK v35, Max SDK 32 and fixed in v36, was discovered to contain hardcoded encryption keys in the encryptionhelper.dart file...

PT-2025-46669

Name of the Vulnerable Software and Affected Versions Sogexia Android App versions SDK 35 through SDK 32 Description The Sogexia Android App contains hardcoded encryption keys within the encryption helper.dart file. These keys compromise the confidentiality of data encrypted by the application...