Malicious code in siska-sambel43-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86d3e16cd1e8d58db474dd0d20f8a9b2eb2e69549c503e6499a24395ded29ce5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-54930 Malicious code in siska-rojak16-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 544400c991577e9a92f0d7d72337e176e93e803eb87f7cb77aab510fc03c0d9c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rina-kue15-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f16770dd6e24c35def1f83d21db3873ed2a3bbabf33930e0574b0d5c69d2b566 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hanafi-tapai69-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13f660fcf6201d787365c6d34ce6cc531c32a68b0f2a1b6f78d21ed83c350e72 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in joko-lontong64-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbae03aeff0cd20b74265ba31261ccef9b54422a89da67dafbe43c1767bacd28 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jaja-moci15-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37c284da4395ec0612633c3a81e9027ac879129b4fb84f33a5c5430cd280aff0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-53078 Malicious code in joni-tomat56-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca1ec4780e483f2dfd95b9a066a75a2a5c6eb57b247a51f5126950edf5091655 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eka-tomat89-sumpek (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9316055e8aac85f2aafdab145f406084277297c4a005769c25dec491fd7c3ff1 The package eka-tomat89-sumpek was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...

Malicious code in citra-serimuka83-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b52fc037341fba2e106bc920ed34c2a6e6614ac273d1f4f5250fae4df4ede78 The package citra-serimuka83-miaww was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

thunderbird: firefox: An OBJECT tag type attribute overrode browser behavior on web resources without a content-type

A flaw was found in Thunderbird and Firefox. The Mozilla Foundation's Security Advisory describes the following issue: A malicious page could have used the type attribute of an OBJECT tag to override the default browser behavior when encountering a web resource served without a content-type. This...

CVE-2025-64181: Use of Uninitialized Variable

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.0 through 3.3.5 and 3.4.0 through 3.4.2, while fuzzing openexrexrcheckfuzzer, Valgrind reports a conditional branch depending on...

Incorrect Behavior Order

Overview ai is an AI SDK by Vercel - The AI Toolkit for TypeScript and JavaScript Affected versions of this package are vulnerable to Incorrect Behavior Order via the downloadAssets function. An attacker can upload files with disallowed types by substituting arbitrary downloaded bytes for differe...

BLADE: Behavior-Level Anomaly Detection Using Network Traffic in Web Services

With their widespread popularity, web services have become the main targets of various cyberattacks. Existing traffic anomaly detection approaches focus on flow-level attacks, yet fail to recognize behavior-level attacks, which appear benign in individual flows but reveal malicious purpose using...

Fedora 43 : mupen64plus (2025-123e2abe71)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-123e2abe71 advisory. Patch CVE-2025-29366 and CVE-2025-29366 There should be no change in behaviour. Tenable has extracted the preceding description block directly from the Fedor...

PT-2025-49382

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw in the sctp transport update rto function that may lead to a shift-out-of-bounds condition. This issue was identified by syzbot, which reported a potenti...

Adversarially Robust and Interpretable Magecart Malware Detection

Magecart skimming attacks have emerged as a significant threat to client-side security and user trust in online payment systems. This paper addresses the challenge of achieving robust and explainable detection of Magecart attacks through a comparative study of various Machine Learning ML models...

MQTT does not validate hostnames

A flaw was found in Rubygem MQTT. By default, the package used to not have hostname validation, resulting in possible Man-in-the-Middle MITM attack...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988914)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988914 advisory. In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on curseg-alloctype As Wenqing Liu reported in bugzilla:...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988664)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988664 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7 For pptable structs that use flexible array...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989007)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989007 advisory. In the Linux kernel, the following vulnerability has been resolved: fs/jfs: Add check for negative dbl2nbperpage l2nbperpage is log2number of blks per page, and the...