solana-stable-web-huks is a malicious package. This package contains malicious code that exfiltrate Solana private keys.

strawberry-graphql is an A library for creating GraphQL APIs

Affected versions of this package are vulnerable to Insufficient Type Distinction in the relay integration that affects multiple ORM integrations (Django, SQLAlchemy, Pydantic). An attacker can access unauthorized data by querying for a specific type using the global node field, which may incorrectly return an instance of a different type mapped to the same model.

Note:

This is only exploitable if Multiple GraphQL types inherit from relay.Node, these types are mapped to the same database model and the global node field is used for type resolution.

org.verapdf:core-arlington is an industry supported, open source PDF/A validation library

Affected versions of this package are vulnerable to XML External Entity (XXE) Injection via the CLI when executing policy checks using custom schematron files due to improper parsing of policyfile in the mergeEnabledFeaturesFromPolicy function. An attacker can execute arbitrary code by injecting malicious XSLT code into the policy files.