EUVD-2025-177477

Malicious code in old-export-class-cron-deploy npm...

MAL-2025-189929 Malicious code in throw-simple-old-export-info (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7fa0e7015572a5c0c2140d2bd0a0d6d2e85a91da0626aa234799986419d1f56 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189656 Malicious code in star-route-query-export-process (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c20beac557c34a749310f87e0f1b74f8044729c51c474177886ce1fc005f2d3b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-175693

Malicious code in void-uglify-warn-export-zero npm...

MAL-2025-189344 Malicious code in sandbox-table-async-void-export (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72eae7b8d712aa5d5e83ef1d75048d703c8d4e2aecb113194cc338645618df7a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-178960

Malicious code in export-hot-cold-orchestrate-awk npm...

EUVD-2025-179141

Malicious code in encode-route-deserialize-eta-export npm...

MAL-2025-185433 Malicious code in alpha-integer-pi-assert-export (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a34951bfb26b2bf73403b5a41d1b38d6088c5a6558b84230cd7bb1e901125fa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-178882

Malicious code in float-encrypt-awk-dog-export npm...

Malicious code in route-proxy-alpha-export-monitor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82ed7ce7a196ba7ed5bc586cfdd287f1bcf2abf295da782560005753652fe5b2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-179852

Malicious code in cat-encrypt-export-kappa-validate npm...

EUVD-2025-178958

Malicious code in export-resolve-theta-slow-refactor npm...

EUVD-2025-176531

Malicious code in sandbox-table-async-void-export npm...

EUVD-2025-177464

Malicious code in omicron-final-fire-export-star npm...

EUVD-2025-178961

Malicious code in export-decompress-integer-encrypt-void npm...

PT-2025-46815

Name of the Vulnerable Software and Affected Versions WebToffee Order Export & Order Import for WooCommerce versions through 2.6.7 Description The software contains a flaw related to incorrectly configured access control, allowing for unauthorized access. The issue impacts the Order Export & Orde...

PT-2025-46782

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce plugin for WordPress versions prior to 2.11.25 Description The Welcart e-Commerce plugin for WordPress has a flaw that allows unauthorized access to data. This is due to a missing capability check on the usces export action...

CVE-2025-52186: Server-Side Request Forgery (SSRF)

Lichess lila before commit 11b4c0fb00f0ffd823246f839627005459c8f05c 2025-06-02 contains a Server-Side Request Forgery SSRF vulnerability in the game export API. The players parameter is passed directly to an internal HTTP client without validation, allowing remote attackers to force the server to...

CVE-2025-64382: Missing Authorization

Missing Authorization vulnerability in WebToffee Order Export & Order Import for WooCommerce order-import-export-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Export & Order Import for WooCommerce: from n/a through = 2.6.7...

Lila security vulnerabilities

lila is an ad-free and open source chess server from Lichess Open Source. A security vulnerability exists in lila, which stems from the unvalidated direct passing of the players parameter in the game export API, which could lead to server-side request forgery...