MAL-2025-167155 Malicious code in teagood-manaki86 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e41865f5d9b2efb9b7cefdd6ca13f6e5fa7d7312ee9a17131396039f0f3ccaf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-164281 Malicious code in pitra-13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bd6003bf6495411bfd30f3cd1b8504d514f7033c597ed2d201a7a94280f393c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-166387 Malicious code in sunder-uyilu-vanmiun (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3e6f3b955e17a7ea35b17a024f3729708f62ffc0aba2a41996540032b7dd731 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-163989 Malicious code in parwo-poke2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 346b225c378f3d2a7f8db5265c91605b98a7393cceef713d22a51c31299b6023 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-11795 JPG File Parsing Out-of-Bounds Write Vulnerability

A maliciously crafted JPG file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process...

CVE-2025-64280

A SQL Injection Vulnerability in CentralSquare Community Development 19.5.7 allows attackers to inject SQL via the permitno field...

CVE-2025-11367

The N-central Software Probe 2025.4 is vulnerable to Remote Code Execution via deserialization...

CVE-2025-11367 N-central windows software probe Remote Code Execution

The N-central Software Probe 2025.4 is vulnerable to Remote Code Execution via deserialization...

CVE-2025-11367 N-central windows software probe Remote Code Execution

The N-central Software Probe 2025.4 is vulnerable to Remote Code Execution via deserialization...

CVE-2025-11367

The CVE-2025-11367 entry affects the N-central Software Probe (windows) prior to version 2025.4. The vulnerability relies on deserialization, allowing remote code execution with network access and no authentication. Impact is described as full compromise of affected systems (high confidentiality,...

Update: Implementation Guidance for Emergency Directive on Cisco ASA and Firepower Device Vulnerabilities

CISA has released Emergency Cisco Directive 25-03 Implementation Guidance to assist federal agencies in addressing critical vulnerabilities in Cisco Adaptive Security Appliances ASA and Firepower devices. Emergency Directive 25-03: Identify and Mitigate Potential Compromise of Cisco Devices, issu...

bind: Cache poisoning attacks with unsolicited RRs

A vulnerability exists in BIND’s DNS resolver logic that makes it overly permissive when accepting resource records RRs in responses. Under certain conditions, this flaw allows attackers to inject unsolicited or forged DNS records into the cache. This can be exploited to poison the resolver cache...

Security update for runc

This update for runc fixes the following issues: Update to runc v1.3.3. Upstream changelog is available from . bsc1252232 CVE-2025-31133 CVE-2025-52565 CVE-2025-52881 Update to runc v1.3.2. Upstream changelog is available from bsc1252110 Includes an important fix for the CPUSet translation for...

RHSA-2025:20801 Red Hat Security Advisory: libtiff security update

Bulletin has no description...

CVE-2025-64403

CVE-2025-64403 affects Apache OpenOffice up to version 4.1.15 (Calc external data sources and other external links). Root cause is missing authorization checks that allow an attacker to craft a document to load links without prompting the user. A fix is available in OpenOffice 4.1.16. Other relat...

Prototype Pollution

dref is vulnerable to Prototype Pollution. The vulnerability is due to improper validation of user-supplied input in the lib.set function, which allows an attacker to inject malicious properties into the Object.prototype, leading to a potential denial of service DoS condition...

Phishing Attack

github.com/rancher/rancher is vulnerable to Phishing Attack. The vulnerability is due to a weakness in the custom SAML authentication protocol used by the Rancher CLI, which allows an attacker to steal authentication tokens through crafted phishing attempts...

EUVD-2025-113173

Malicious code in global-karma-socketio-algol npm...

EUVD-2025-112034

Malicious code in jwt-magellan-sedna-stop npm...

Malicious code in inquirer-prettier-plugin-markdown-writable-fomalhaut (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aba576cee921af273a381ecdd9f50e7948d25e4e33e507595011c39819ada9e9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...