EUVD-2025-81394

Malicious code in leonard-tea-archive npm...

EUVD-2025-81165

Malicious code in mosley-tea-archive npm...

EUVD-2025-81865

Malicious code in francesca-tea-archive npm...

Malicious code in gerald-tea-archive (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89a01a941a2efe401c486c02910c49c474f7d070e2c0e4f2c65348bb33c73569 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-80948

Malicious code in pete-tea-archive npm...

EUVD-2025-80677

Malicious code in ronald-tea-archive npm...

Malicious code in darrin-tea-archive (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cc7637187393445a0cb8e62d9563a1333e7c216c3b5a92c3b8453599cb8b7c2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-100573 Malicious code in clark-tea-archive (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea19685a16fcc4a79d2d300a82c9eace9e35fb566f306b7156a0a0324a93c010 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-100630 Malicious code in cochran-tea-archive (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef25c5f848314f4c87933e4ec32be85e920f11a2f28253cbf523ce44621e5d4d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-101214 Malicious code in darrin-tea-archive (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cc7637187393445a0cb8e62d9563a1333e7c216c3b5a92c3b8453599cb8b7c2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in stanton-tea-archive (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e8e24d5177c9b6686abab5197356c6c1a4a5c3ef624b5307482e99d922a97a8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-79746

Malicious code in barber-tea-archive npm...

Amazon Linux 2 : oci-add-hooks, --advisory ALAS2ECS-2025-080 (ALASECS-2025-080)

The version of oci-add-hooks installed on the remote host is prior to 0-0.5.20200504git325a340. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2025-080 advisory. net/url: insufficient validation of bracketed IPv6 hostnames The Parse function permitted values...

Advisory ROSA-SA-2025-3060

Software: bzip2 1.0.6 OS: ROSA Virtualization 2.1 unaffected versions = bzip2-1.0.6-28.rv3 affected versions bzip2-1.0.6-28.rv3 CVE-ID: CVE-2019-12900 BDU-ID: CVE-Crit: HIGH CVE-DESC.: A vulnerability in the BZ2decompress decompress.c function of the bzip2 data compression utility is related to...

Important: libcap

Issue Overview: net/url: insufficient validation of bracketed IPv6 hostnames The Parse function permitted values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed withi...

Important: runc

Issue Overview: Placeholder CVE. Details forthcoming CVE-2025-31133 net/url: insufficient validation of bracketed IPv6 hostnames The Parse function permitted values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to b...

ROS-20251110-02

A vulnerability in the 7-Zip file archiver is related to incorrect symbolic link detection before file access. before accessing a file. Exploitation of the vulnerability could allow an attacker to execute arbitrary code if a user opens a specially crafted ZIP archive. provided the user opens a...

Advisory ROSA-SA-2025-3045

Software: bzip2 1.0.6 OS: ROSA Virtualization 3.1 unaffected versions = bzip2-1.0.6-28.rv31 affected versions bzip2-1.0.6-28.rv31 CVE-ID: CVE-2019-12900 BDU-ID: CVE-Crit: HIGH CVE-DESC.: A vulnerability in the BZ2decompress decompress.c function of the bzip2 data compression utility is related to...

FBI Wants to Know Who Runs Archive.ph

The FBI has issued a federal subpoena to domain registrar Tucows, demanding extensive billing and session records to unmask the anonymous operator of Archive.ph Archive.is and Archive.today. The site, known for bypassing paywalls, is now the subject of an undisclosed criminal investigation...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview mqtt is a Pure Ruby gem that implements the MQTT protocol, a lightweight protocol for publish/subscribe messaging. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip due to the lack of hostname validation in the connection process. An...