Malicious code in dono-tek38-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6246ce058d23e49393e076b199e827a5080d8f460e5b1b3a704da4b93c46c53 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in riana-ragi93-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 761b63de8c6f75e682d850d7b317b06c0d8ddeb00b8fb7adc079c6b1ba86d1ad This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in patria-sate100-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad0523dab361527fdf966b2cd9df2c3748028f7269c6c7864199e6aa98ac7325 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in riana-kupat73-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35ddc1359ccb55c21f09b72d2e5a5bf1c9ec919662ecb22f4af42ae85a0fc66d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in crucial-red-quokka (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e8cc5ae80c7bbd1c226867c96be67aa5906952ada4802a6ac6358a4399a4dca This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in riana-getuk51-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddfddfadc23cdea59a8f75949c26db28173c788ae79da9e1abffcacfd5715e2f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-62211: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' in Dynamics 365 Field Service online allows an authorized attacker to perform spoofing over a network...

Malicious code in riana-mangut44-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bf2b2256442b707ff1aee9cda3b46831a2bbe72a9a864ad757c6fde92750fe4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in riana-pecel12-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a3032f19f380cd8a0a83ea7b646e0d70d77f584e2734a1b9a2fdafda8193666 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-43038

Malicious code in irma-nasicampur1-breki npm...

EUVD-2025-38719

Malicious code in @mycorp/pkg-a npm...

Malicious code in @mycorp/pkg-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 531827e251b21e7cdd9b8120a48e7d9bc30f8ee1ecbf032ae85a898db42c7113 The package @mycorp/pkg-a was found to contain malicious code. Source: ghsa-malware 2491733d0db409cabaee167bb381c00fca71da3019c80332ea3ca29b3eb15c74...

CVE-2025-64346: Improper Limitation of a Pathname to a Restricted Directory

archives is a Go library for extracting archives tar, zip, etc.. Version 1.0.0 does not prevent a malicious user to feed a specially crafted archive to the library causing RCE, modification of files or other malignancies in the context of whatever the user is running this library as, through the...

CVE-2025-64184: Improper Limitation of a Pathname to a Restricted Directory

Dosage is a comic strip downloader and archiver. When downloading comic images in versions 3.1 and below, Dosage constructs target file names from different aspects of the remote comic page URL, image URL, page content, etc.. While the basename is properly stripped of directory-traversing...

CVE-2025-58423: Improper Limitation of a Pathname to a Restricted Directory

Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to cause a denial-of-service condition, traverse directories, or read/write files, within the context of the local system account...

CVE-2025-49904: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Reflected XSS.This issue affects Booking and Rental Manager: from n/a through = 2.5.3...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990523)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990523 advisory. In the Linux kernel, the following vulnerability has been resolved: xhci: Fix command ring pointer corruption while aborting a command The command ring pointer is...

USN-7833-4: Linux kernel (GCP) vulnerabilities

Oleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos, and Flavien Solt discovered that some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information. A local attacker could possibly use this to...

F5 Networks F5OS-A/F5OS-C Multiple Vulnerabilities (K000156767, K000156771, K000156796)

The version of F5 Networks F5OS-A or F5OS-C installed on the remote host is affected by a vulnerability as referenced in the K000156767, K000156771 and K000156796 security advisories. - A vulnerability exists in F5OS-A and F5OS-C systems that may allow an authenticated attacker with local access ...

F5 Networks F5OS-A FIPS HSM Password Initialization (K000154661)

The version of F5 Networks F5OS-A installed on the remote host is affected by a vulnerability as referenced in the K000154661 advisory. - When a user attempts to initialize the rSeries FIPS module using a password with special shell metacharacters, the FIPS hardware security module HSM may fail t...