416 matches found
GHSA-XJR7-3C3G-M763 Renovate vulnerable to arbitrary command injection via gleam manager and malicious gleam.toml file
Summary The user-provided string depName in the gleam manager is appended to the gleam deps update command without proper sanitization. Details Adversaries can provide a maliciously crafted gleam.toml in conjunctions with a tweaked Renovate configuration file to trick Renovate to execute arbitrar...
python39:3.9 and python39-devel:3.9 security update
An update is available for module.python-psutil, python-packaging, module.Cython, module.python-iniconfig, module.python-wcwidth, module.python-ply, python-psutil, python-chardet, module.python-pluggy, python-lxml, python-pysocks, python-wcwidth, python-pluggy, module.python-attrs, Cython,...
HSEC-2023-0007 readFloat: memory exhaustion with large exponent
readFloat: memory exhaustion with large exponent Numeric.readFloat takes time and memory linear in the size of the number denoted by the input string. In particular, processing a number expressed in scientific notation with a very large exponent could cause a denial of service. The slowdown is...
Malicious code in markdownlint-rollup-loglevel-toml (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbc9bcd9f7f8ab3bac1cfef2c4e32342014982407e7e69dedb4ebd4e42256d0e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-180014
Malicious code in blueshift-toml-bellatrix-blueshift npm...
EUVD-2025-178586
Malicious code in hawkingradiation-ora-celeste-toml npm...
EUVD-2025-175931
Malicious code in toml-apollo-materialize-hexo npm...
EUVD-2025-178492
Malicious code in husky-build-toml-troposphere npm...
EUVD-2025-177944
Malicious code in markdownlint-rollup-loglevel-toml npm...
EUVD-2025-176635
Malicious code in rigel-toml-meteor-version npm...
EUVD-2025-175927
Malicious code in toml-jwt-docusaurus-celeste npm...
Malicious code in vuepress-toml-magellan-rimraf (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d73486af759f7bf45f85de2534aee0ca48048d4c03aafacd5b532d679496ef3e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-176049
Malicious code in taurus-deimos-package-toml npm...
Malicious code in toml-superflare-rollup-algol (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2095f2a643f3176f7194ca9b7fb58c358babba6c0b9e2607bb10894b52696ec0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-175928
Malicious code in toml-json-express-event npm...
EUVD-2025-175682
Malicious code in vuepress-toml-magellan-rimraf npm...
MAL-2025-186021 Malicious code in castor-cosmology-planetology-toml (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0793b946fb175d66296827fcb218b871018110b0a8b6cfd2e04dfd5583e18fea This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-179465
Malicious code in css-loader-rehype-toml-version npm...