A vulnerability in the MongoDB Go Driver version 3.0 allows for application denial of service due to missing validation of BSON array length. This flaw can cause the application to malfunction or crash when processing specially crafted BSON data.
An integer overflow vulnerability in the BSON value-length validation of the MongoDB Go Driver version 3.0 can lead to an application denial of service. This flaw is identified as CWE-190 and affects exactly version 3.0 of the driver. No CVSS score is provided, and no known exploits are reported in the wild. No patch or remediation details are currently available.
A vulnerability in the Omnibox component of Google Chrome on Android versions prior to 155.0.8059.39 allows a remote attacker to bypass the web origin policy via crafted HTML and social engineering. This improper input validation flaw has a medium severity rating and could lead to limited confidentiality and integrity impacts.
A missing authorization vulnerability in the Translate feature of Google Chrome prior to version 155.0.8059.39 allows a remote attacker who has compromised the renderer process to bypass site isolation using a crafted HTML page. This vulnerability has a medium severity rating with a CVSS score of 4.2.
A missing authorization vulnerability in the BrowserTag component of Google Chrome versions prior to 155.0.8059.39 allows a remote attacker who has compromised the renderer process to bypass site isolation using social engineering with a crafted HTML page. The vulnerability has a medium severity rating.
The bitcoin-rpc-lite RubyGem version 1.0.0 and 1.0.3 contains malicious code in its native extension build script extconf.rb. This script executes automatically during gem installation and, after evasion checks, opens a reverse shell to a hardcoded attacker IP address, allowing remote code execution. The malicious payload is concealed via Base64 encoding and delayed execution to evade detection in short-lived environments.
The RubyGems package 'web3-eth-utils' version 1.0.0 and 1.0.3 contains malicious code that executes during gem installation. The native extension script performs environment checks to evade sandbox and CI environments, then decodes and executes a Ruby payload that establishes a persistent reverse shell to a remote IP address. The package is a typosquat lure mimicking legitimate web3/eth ecosystem packages, with the actual malicious behavior hidden in the install-time hook.
The RubyGems package 'btc-wallet-tools' version 1.0.0 and 1.0.3 contains malicious code in its native extension script 'ext/req_throttle_mini/extconf.rb'. This script executes during gem installation and, after performing environment checks to evade analysis, decodes and runs a Base64-encoded Ruby payload that opens a reverse shell to a remote attacker. The reverse shell connects to IP 45.138.12.177 on TCP port 8090, providing the attacker with remote shell access to the host. The malicious behavior is concealed by delaying execution and checking for developer artifacts, making detection difficult during automated scans.
The RubyGems package 'wallet-crypto-utils' version 1.0.0 and 1.0.3 contains malicious code in its native extension script that executes during gem installation. The code performs environment checks to evade sandbox and CI environments, then decodes and executes a payload that opens a reverse shell to a remote IP address. This allows an attacker to gain interactive shell access to the developer's machine, potentially compromising sensitive credentials and developer artifacts.
The RubyGems package 'crypto-mnemonic-tools' version 1.0.0 and 1.0.3 contains a malicious native extension script that executes during gem installation. The script performs environment checks to avoid CI and sandbox environments, then after a delay, opens a reverse shell to a remote IP address, providing an attacker interactive shell access on the victim's machine. The malicious behavior is hidden behind a decoy Ruby library and uses a double-forked daemon process to evade detection.
The RubyGems package 'eth-keystore-utils' version 1.0.0 and 1.0.3 contains a malicious native extension script that executes a hidden payload during gem installation. The payload establishes a persistent reverse shell to a hardcoded IP address, allowing remote command execution. The malicious code evades detection by checking for CI environments, sandbox indicators, and the presence of developer secrets before activating. The package was published on 2026-10-05 and targets Ethereum developers likely to have sensitive wallet and credential files.
The RubyGems package 'eth-address-utils' version 1.0.0 and 1.0.3 contains a malicious native extension script that executes a hidden reverse shell payload during installation. The payload activates only on developer workstations, avoiding CI environments and sandboxes, and connects to a remote attacker-controlled server to provide full remote code execution under the installing user's privileges.
The npm package tostpro@100.2.0 contains a malicious preinstall script that executes automatically during installation. This script is obfuscated and designed to send the full environment variables, potentially including sensitive credentials, to a remote server after a specific date in 2026. The package's README falsely claims no network access or data collection, indicating deliberate evasion. This behavior poses a significant risk of credential leakage and unauthorized data exfiltration.
The npm package 'exodus-firestore-synchronize' version 0.0.1 contains malicious code in its postinstall script that runs automatically during installation. This script executes system commands to identify the current user and hostname, then enumerates environment variables for keys that resemble credentials or tokens, printing these values to the installation log. The package impersonates an internal 'Exodus Wallet SDK' and is designed as a dependency confusion demonstrator to intercept installations intended for an internal package. Although it does not transmit data externally, the exposure of sensitive environment variables in install logs, especially on CI systems, poses a risk of credential leakage.
SUSE released a security update for the Linux Kernel used in SUSE Linux Enterprise Server 16.0 and SUSE Linux Micro 6.2. The update addresses multiple security bugs across various kernel subsystems including networking, scheduling, memory management, filesystems, and device drivers. These fixes resolve issues such as race conditions, use-after-free, null pointer dereferences, deadlocks, and other kernel-level bugs. The update is intended to improve system stability and security by patching these vulnerabilities.
This entry refers to a security update for the MeCab software package provided by the SUSE Product Security Team. It is a functional equivalent of the Red Hat advisory RHSA-2025:16046. No specific technical details or affected versions are provided in the input data. The severity is indicated as medium, but no CVSS score is available.
A security update for GnuTLS has been released by the SUSE Product Security Team. This update is functionally equivalent to the Red Hat advisory RHSA-2025:16116. No specific technical details or affected versions are provided in the available information. The severity is assessed as medium.
Multiple security issues have been fixed in the libQt5Pdf5-5.15.19-1.1 package on the GA media of openSUSE Tumbleweed. These vulnerabilities affect the SUSE product and have been collectively addressed in this package update. No specific affected versions are detailed, and no CVSS score is provided. The overall severity is assessed as medium based on the information available.
This is a security update for WebKit2GTK3 addressing vulnerabilities referenced in Red Hat advisory RHSA-2025:13780. The update is provided by the SUSE Product Security Team and relates to multiple CVEs including CVE-2025-31273. No specific affected versions or technical details are provided in the input data.