CVE-2025-14346

WHILL Model C2 Electric Wheelchairs and Model F Power Chairs do not enforce authentication for Bluetooth connections. An attacker within range can pair with the device and issue movement commands, override speed restrictions, and manipulate configuration profiles without any credentials or user...

GHSA-6H7W-V2XR-MQVW Bagisto Missing Authentication on Installer API Endpoints

Vulnerable Code File: packages/Ibkul/Installer/src/Routes/Ib.php groupfunction Route::controllerInstallerController::class-\groupfunction Route::get'install', 'index'-\name'installer.index'; Route::middlewareStartSession::class-\prefix'install/api'-\groupfunction Route::post'env-file-setup',...

CVE-2025-61740

Authentication issue that does not verify the source of a packet which could allow an attacker to create a denial-of-service condition or modify the configuration of the device...

CVE-2025-63219

The ITEL ISO FM SFN Adapter firmware ISO2 2.0.0.0, WebServer 2.0 is vulnerable to session hijacking due to improper session management on the /home.html endpoint. An attacker can access an active session without authentication, allowing them to control the device, modify configurations, and...

CVE-2025-63219

The CVE-2025-63219 issue affects the ITEL ISO FM SFN Adapter, specifically firmware ISO2 2.0.0.0 and WebServer 2.0. The root cause is improper/session management on the /home.html endpoint, allowing an unauthenticated user to hijack an active session and potentially control the device and modify ...

Malicious code in technosignature-eslint-plugin-deimos-stop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59655cd4ef955dfbcaad401568c4eaa54de4cf841a6588794b7a680f8c055fc6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187985 Malicious code in mesosphere-bootes-primatology-levels (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a8eb4476e67bc8ba2d8ab0e4bd9d74c8303fd6ff5f358e8668ac8c8457cf414 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-188363 Malicious code in npm-publish-cross-env-jest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f326fe849575cb4d47994a975a7fe829719b21959ffb49ef1ac24126a1519ae8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189290 Malicious code in run-script-juno-supernova-commitlint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28d5416570aa5bf98628db20b38d6aa688ee1a11743013f75bbbf34b033fb219 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189659 Malicious code in start-iota-webpack-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a864f90e149e2b4496c53b9311b410904ffa98c5015ec30a16c6e3787810c0a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in meteor-hadron-hermes-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 406ee3b851ee1ae01cae0c7e1ae0e6a83e9ce50744299402f3c59a7ed7950003 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187990 Malicious code in mesosphere-jupiter-sirius-spinner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9644d9c205b35461491024d83d86512d91f81d021787e7443dcc5b68ff0c4ede This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-190211 Malicious code in warn-bash-grep-array-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8bc328598631e616c53ed70b1dfd4a169e5b60020465e7e29511eb35b9d538a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-183308 Malicious code in libc-ubg-ag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 363a0abb6422ac1ec7e515a556af29bcc40d6db24c8efd4ee80d95dfcba2ae7f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lobac-ubb-gab (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f53c003c016d5a91c9cee42f7211faef58951706c3ec9a6df8cfac3e9afd5f64 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in modiov-kihan-afmcaun (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8897a563abc379050833f5d324bb78ed86310825ffec863677fbcfdc760a3d2d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gociy-ng-ugu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b2b190442dfab4015dbf4cc7e91dd90fb4510df45b1afafc37462b2418e84d7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in anabuyil-inanau-nii (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 911f7d3ede5610bfe2c04304b331596c38cbc6d0591426475091bd3f0b44626e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-ozuwo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ab266077506e036c956c8b13092b910ca2b6621fe5a44cd684675f8b9c5f645 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kiut-acg-aveucf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d71a71ab990919dcf18a1e3b969488deaa8b7001b1bc5ab7eceb758609b1f1e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...