Malicious code in common_zebra_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7455320a8de443c6b454b1be8bbddf048eb695c2ac31051d3617379b8ef0f20d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-64902

Malicious code in commonzebraz3n npm...

Malicious code in common_mastodon_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3303139183d8764cab066d0e1b685ff3baa10e36d00493a22d91a1959bd9b8d8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-84209 Malicious code in common_mastodon_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3303139183d8764cab066d0e1b685ff3baa10e36d00493a22d91a1959bd9b8d8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-86702

Malicious code in commonmastodonz3n npm...

EUVD-2025-55320

Malicious code in common-plum-barracuda npm...

MAL-2025-67330 Malicious code in common-red-sparrow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 753faff89b4f300426746bc70b549687722edd1f4875a2baf6da599de95a4dd6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-55318

Malicious code in common-scarlet-gull npm...

EUVD-2025-55317

Malicious code in common-turquoise-bat npm...

EUVD-2025-55319

Malicious code in common-red-sparrow npm...

EUVD-2025-55321

Malicious code in common-crimson-booby npm...

Malicious code in common-scarlet-gull (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68ec4e0ef4dffcb3c2477543413de5314f165cdd547db58990ed85a53f0e36b4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

SUSE CVE-2025-64432

KubeVirt is a virtual machine management add-on for Kubernetes. Versions 1.5.3 and below, and 1.6.0 contained a flawed implementation of the Kubernetes aggregation layer's authentication flow which could enable bypass of RBAC controls. It was discovered that the virt-api component fails to...

EUVD-2025-60266

Malicious code in commonkangarooz3n npm...

EUVD-2025-60268

Malicious code in commonchickadeez3n npm...

DEBIAN-CVE-2025-12725

Out of bounds read in WebGPU in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. Chromium security severity: High...

DEBIAN-CVE-2025-12434

Race in Storage in Google Chrome on Windows prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-64431

creationtimestamp| type| source ---|---|--- 2025-11-07 21:15:54+00:00| seen| https://bsky.app/profile/jos1264.social.skynetcloud.site.ap.brid.gy/post/3m52yrhsvnsu2 2025-11-07 22:20:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m534esgqtm2n...

Incorrect Permission Assignment for Critical Resource

Overview Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource due to the virt-api component failing to validate the CN field in client TLS certificates against allowed values in the extension-apiserver-authentication configmap. An attacker can...

AZL-69793 CVE-2025-64432 affecting package kubevirt for versions less than 1.5.3-2

KubeVirt is a virtual machine management add-on for Kubernetes. Versions 1.5.3 and below, and 1.6.0 contained a flawed implementation of the Kubernetes aggregation layer's authentication flow which could enable bypass of RBAC controls. It was discovered that the virt-api component fails to...