CVE-2025-5454

An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker...

Malicious code in hadi-brongkos82-pore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f0d6a2fe8a0ae880668cd87f72986f510724c95387bdabd54d133dce65a2053 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-96959 Malicious code in tense_cardinal_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9f52c7c64462e166ac5263c43eca8d1f767dc58bb33e360b434a1084af9ee88 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-97283 Malicious code in vivid_bird_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85b24778e683965e250eb68f37a739fe7a118d90df7861b2f1ae908653b8cb00 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rolling_cat_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8c5111caa1c2952a02647c1484752d9f577f28f8ff1797660e11b1ec0add415 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-78435 Malicious code in gita-bakso13-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00423d1012d91b68ea62eff7eab1ae87a6a4c71dd952b977ddfe745c1a69aacf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in zain-mangga60-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75c284d066c565a9270c281f08f68c0f3ae69dce11f0437cfc5956cf925f780a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in citra-tahutek88-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9824d6e0d6529777f867a9075befb93d71f0b43ddbec4cbc2e5222c4873388b7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in joni-otak-otak97-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5186dd8c2dda512fdc9d6e59b543ce84fcd34f6f15d40f3419d55a4f4d306c62 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ogi-kepok41-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2771ae3a832a63b69d2f55105cb651def07631f11e8ae0a09a0291f6b6271489 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in profound-gray-grasshopper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3cbd0fbe549adf9cfbf2db3df1f64377a2540538a34b3a2243167ae9f9d12805 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-67127 Malicious code in cautious-plum-chameleon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 368c9042c83f8950aa8c0edc648b79403189299aafc5db04a902331ea2c43f3c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ida-brongkos75-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c89be3f058209a45605990dba1d51746a0bd0d5a1782c273bd976440658ccc14 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-62353 Malicious code in citra-tumis62-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3617241e910a645956a0c0b5145421fe7ac739c40fe865a1af7a2ece2397302a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

PT-2025-51635

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains an issue in the pinctrl subsystem, specifically within the s32cc driver. The s32 pinctrl desc structure is allocated using devm kmalloc, but not all of its fiel...

Advantech WebAccess/VPN Absolute Path Traversal Vulnerability

Advantech WebAccess/VPN is a virtual private network feature integrated in Advantech WebAccess/SCADA software, designed to provide a secure and reliable network connectivity solution for industrial automation and remote monitoring systems. An absolute path traversal vulnerability exists in...

ALSA-2025:20957 Important: runc security update

The runC tool is a lightweight, portable implementation of the Open Container Format OCF that provides container runtime. Security Fixes: runc: container escape via 'masked path' abuse due to mount race conditions CVE-2025-31133 runc: container escape with malicious config due to /dev/console mou...

RHEL 10 : shadow-utils (RHSA-2025:20145)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:20145 advisory. The shadow-utils packages include programs for converting UNIX password files to the shadow password format, as well as utilities for managing user...

RHEL 10 : sssd (RHSA-2025:21020)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:21020 advisory. The System Security Services Daemon SSSD service provides a set of daemons to manage access to remote directories and authentication mechanisms. It...

EUVD-2025-48940

Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, an administrator can, by editing the configuration of the iTop instance, execute code on the server. Versions 2.7.13 and 3.2.2 escape and check the config parameter before executing a command based on i...