MAL-2025-2300 Malicious code in client-analytisc-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1413ae1456fe5f357befbd198d3c85b98e8d40e31b0d76c343d1cb6a9dfc9d95 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2319 Malicious code in ledger-node-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7407ff449f6702424fde06ca2cab289054c649439e98f9b863029a985e8cfcf7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2252 Malicious code in dir-size-analyzer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f803eeed1967e8ae2cd3095d6f293153fe8b5574bbef8aa2191c4b2f862658f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2285 Malicious code in veryimportantdigiasdf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4216b87b158de7023dfdcc03968bb866298708f6f98f34877f88eb9e74b20eb8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

RHSA-2025:2524 Red Hat Security Advisory: kernel-rt security update

Bulletin has no description...

RHSA-2025:2517 Red Hat Security Advisory: kernel security update

Bulletin has no description...

CVE-2025-1920

Type Confusion in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

GO-2025-3500 In-memory stored Cross-site scripting (XSS) vulnerability in pineconesim in github.com/matrix-org/pinecone

In-memory stored Cross-site scripting XSS vulnerability in pineconesim in github.com/matrix-org/pinecone...

CGA-X223-M8F5-C9VM

Bulletin has no description...

GO-2025-3507 Horcrux Double Sign Possibility in github.com/strangelove-ventures/horcrux

Horcrux Double Sign Possibility in github.com/strangelove-ventures/horcrux...

GO-2025-3505 Fleet has SAML authentication vulnerability due to improper SAML response validation in github.com/fleetdm/fleet

Fleet has SAML authentication vulnerability due to improper SAML response validation in github.com/fleetdm/fleet. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...

GO-2025-3504 Envoy Gateway Log Injection Vulnerability in github.com/envoyproxy/gateway

Envoy Gateway Log Injection Vulnerability in github.com/envoyproxy/gateway...

CGA-HFWH-4G67-Q7CM

Bulletin has no description...

CGA-XVG9-G29C-RR68

Bulletin has no description...

MAL-2025-2225 Malicious code in layouts-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 668d31349d49bb3ffdf31cb641b2829be6ffcae92877d17241a593565a0dddb5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PYSEC-2025-22

A vulnerability, that could result in Remote Code Execution RCE, has been found in PlotAI. Lack of validation of LLM-generated output allows attacker to execute arbitrary Python code. Vendor commented out vulnerable line, further usage of the software requires uncommenting it and thus accepting t...

RHSA-2025:2480 Red Hat Security Advisory: firefox security update

Bulletin has no description...

BIT-GITLAB-2025-1540 Incorrect Authorization in GitLab

An issue has been discovered in GitLab CE/EE for Self-Managed and Dedicated instances affecting all versions from 17.5 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2. It was possible for a user added as an External to read and clone internal projects under certain circumstances."...

ALSA-2025:2500 Important: tigervnc security update

Virtual Network Computing VNC is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients...

CVE-2025-27519

Cognita is a RAG Retrieval Augmented Generation Framework for building modular, open source applications for production by TrueFoundry. A path traversal issue exists at /v1/internal/upload-to-local-directory which is enabled when the Local env variable is set to true, such as when Cognita is setu...