Malicious code in magnetic_chipmunk_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07b8ede0c8bb74be245fd49dfeeec51ab3de1ed9f78cf19864421ec0a0b29ee2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wealthy_bedbug_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d361523e299252e15f5761f90e3fc9eb718f43865284b42408a520ef885ba517 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in initial_galliform_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01fdb3bafbee1554bb2476c6fd74461099c2579652510f2f2d6d1385734b4fb4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-128799 Malicious code in naked_canidae_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f795b10fc64b8913a9f59ee787dc4dd0371fec57cbbf60a5331b97094adc2d60 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-130752 Malicious code in udin-liwet76-wekto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d5a0edc01da0b6bc8b9eaec4bfc0f485ed55876b227e80f3270d8162786e6a2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in xaver-menjes50-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31868d050833f7ed5da20e44374ef882f2445a5faf1ede6d7651c58d43d8bc66 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eka-nasipecel56-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fdcac26219ac6de5fe290512c61998eb93a872399e83db078af48fd59c80b63 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-85378 Malicious code in fadhil-tahu31-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47a82084c4171d8b8db86f9a06f5918720cfa2442cb039ee5841210390910cd4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dewanto-kemplang37-kyuki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8939d751ed6eeab197e79accfb1e80e781da7b1f7327bf47d3b9292a60730a71 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kresna-ragi95-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e457f01dd47348a4f3868a81956153209886ccb51e40854a2f398537473db65 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-69047 Malicious code in kimyoonhyeok (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f409f0948b05f83e888b8fe267cfe72a62d4f880b05b893dc08281f16aca6da This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in liberal_marmoset_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6e1e895001a1d39db6d50fa4ea9464e999b3f3c3a40ff1b691d5126cd00ec04 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-61161 Malicious code in related_rat_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0b3537e6787790d0253a157521910deba3161f6aa1590774ba0f04cb0b4b188 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-61629 Malicious code in wet_crane_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7067581be74a739d5f142145c8a99bb4dfdc41c566f83ca1cb5bc27c4829f08 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hadianto-jengkol73-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e19d60310a093f7883456820a462190dbbabf436ef5c711322f3385970a7ce9e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-35819

The Supervisor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX functions in all versions up to, and including, 1.3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update...

EUVD-2025-34972

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to modification of data in all versions up to, and including, 4.2.9.2. This is due to missing capability checks on the Admin Tools REST endpoints which are registered with permissioncallback set to returntrue. This makes it...

mysql: mariadb: InnoDB unspecified vulnerability (CPU Apr 2025)

Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

mysql: InnoDB unspecified vulnerability (CPU Apr 2025)

Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

CVE-2025-55626

The CVE-2025-55626 entry concerns Reolink Smart 2K+ Plug-in Wi‑Fi Video Doorbell with Chime, firmware 3.0.0.4662_2503122283. The vulnerability is an Insecure Direct Object Reference (IDOR) that allows unauthorized access to Admin-only settings and the ability to edit session storage. Root cause i...