CVE-2025-65548

NUT-14 allows cashu tokens to be created with a preimage hash. However, nutshell cashubtc/nuts before 0.18.0 do not validate the size of preimage when the token is spent. The preimage is stored by the mint and attacker can exploit this vulnerability to fill the mint's db nd disk with arbitrary da...

CVE-2025-65548

CVE-2025-65548 affects Nutshell (cashubtc/nuts) prior to 0.18.0. The issue is that when spending a token, the preimage size is not validated, and the preimage is stored by the mint, enabling an attacker to fill the mint’s database and disk with arbitrary data. Public sources consistently describe...

CVE-2025-65548

NUT-14 allows cashu tokens to be created with a preimage hash. However, nutshell cashubtc/nuts before 0.18.0 do not validate the size of preimage when the token is spent. The preimage is stored by the mint and attacker can exploit this vulnerability to fill the mint's db nd disk with arbitrary da...

EUVD-2014-3056

Malware in sbrugna...

EUVD-2019-14090

Malware in sbrugna...

EUVD-2014-3082

Malware in sbrugna...

EUVD-2019-13915

Malware in sbrugna...

Malicious code in spin-spend-ten (npm)

The package spin-spend-ten was found to contain malicious code...

Malicious code in eight-spend-men (npm)

The package eight-spend-men was found to contain malicious code...

MAL-2025-44096 Malicious code in eight-spend-men (npm)

The package eight-spend-men was found to contain malicious code...

MAL-2025-46130 Malicious code in spin-spend-ten (npm)

The package spin-spend-ten was found to contain malicious code...

Malicious code in test-mlw2-spend-daman-mouth-haets (npm)

The package test-mlw2-spend-daman-mouth-haets was found to contain malicious code...

Malicious code in test-mlw2-aloft-spend (npm)

The package test-mlw2-aloft-spend was found to contain malicious code...

MAL-2025-34865 Malicious code in test-mlw2-aloft-spend (npm)

The package test-mlw2-aloft-spend was found to contain malicious code...

MAL-2025-8947 Malicious code in @malware-test-spend-daman-mouth-haets/test-mlw3-spend-daman-mouth-haets (npm)

The package @malware-test-spend-daman-mouth-haets/test-mlw3-spend-daman-mouth-haets was found to contain malicious code...

MAL-2025-36304 Malicious code in test-mlw2-spend-daman-mouth-haets (npm)

The package test-mlw2-spend-daman-mouth-haets was found to contain malicious code...

SQL Injection

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to SQL Injection via spendmanagementendpoints.py. An attacker could potentially inject malicious SQL code through unsanitized input, leading to unauthorized data access or...

fuels-ts 输入验证错误漏洞

fuels-ts is an open source library from Fuel Labs that interacts with Fuel v2. An input validation error vulnerability exists in fuels-ts, which is caused by the "fund" function in "fuels-ts/packages/account/src/account.ts" that uses the function The "getResourcesToSpend" function in...

How to Reduce SaaS Spend and Risk Without Impacting Productivity

There is one simple driver behind the modern explosion in SaaS adoption: productivity. We have reached an era where purpose-built tools exist for almost every aspect of modern business and it's incredibly easy and tempting for your workforce to adopt these tools without going through the formal I...

Evmos vulnerable to exploit of smart contract account and vesting

Summary This advisory board aims to describe two vulnerabilities found in the Evmos codebase: - Authorization check on the fundVestingAccount: unauthorized spend of funds. Details Authorization check on the fundVestingAccount With the current implementation, a user can create a vesting account wi...