EUVD-2025-33723

The Alt Redirect 1.6.3 addon for Statamic fails to consistently strip query string parameters when the "Query String Strip" feature is enabled. Case variations, encoded keys, and duplicates are not removed, allowing attackers to bypass sanitization. This may lead to cache poisoning, parameter...

Improper Validation of Unsafe Equivalence in Input

Overview alt-design/alt-redirect is an Alt Redirect addon, add Redirects to your site Affected versions of this package are vulnerable to Improper Validation of Unsafe Equivalence in Input via handling of query string parameters when the "Query String Strip" feature is enabled. An attacker can...

CVE-2025-60868

The Alt Redirect 1.6.3 addon for Statamic fails to consistently strip query string parameters when the "Query String Strip" feature is enabled. Case variations, encoded keys, and duplicates are not removed, allowing attackers to bypass sanitization. This may lead to cache poisoning, parameter...

CVE-2025-60868

The CVE-2025-60868 entry concerns the Alt Redirect 1.6.3 addon for Statamic. The vulnerability arises from incomplete query string parameter cleanup when the Query String Strip option is enabled: case variations, encoded keys, and duplicate parameters are not consistently removed, potentially ena...

EUVD-2017-17345

Malware in sbrugna...

EUVD-2017-16329

Malware in sbrugna...

EUVD-2013-3871

Malware in sbrugna...

EUVD-2017-16331

Malware in sbrugna...

EUVD-2021-17513

Malware in sbrugna...

EUVD-2021-22946

Malware in sbrugna...

EUVD-2020-0055

Malware in sbrugna...

EUVD-2022-15597

Malicious code in bioql PyPI...

EUVD-2025-16293

Malicious code in bioql PyPI...

EUVD-2025-2134

Malicious code in bioql PyPI...

EUVD-2025-30449

Malicious code in bioql PyPI...

EUVD-2023-50219

Malicious code in bioql PyPI...

EUVD-2024-0048

Malicious code in bioql PyPI...

EUVD-2023-50218

Malicious code in bioql PyPI...

CVE-2025-59526

mailgen is a Node.js package that generates responsive HTML e-mails for sending transactional mail. Prior to version 2.0.30, there is an HTML injection vulnerability in plaintext e-mails generated by Mailgen. Projects are affected if the Mailgen.generatePlaintextemail method is used and given...

When Dependencies Turn Dangerous: Responding to the NPM Supply Chain Attack

On September 8, 2025, attackers compromised a set of 18 widely used npm packages —including chalk, debug, ansi-styles, and strip-ansi—collectively downloaded over 2.6 billion times per week. Through a targeted phishing campaign against a maintainer, the attackers published malicious versions...