MAL-2025-126248 Malicious code in erwin-kripik72-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a81c3552a407c208fabe87a0ea6a5d00c8c3caf65a7471cb19282f905b74e32 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in candra-nasi69-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75eaba79cb8f8a18a156de138f620346288914d89686d539b0f30e02dd14de70 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lina-donat31-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c04b1bfd30b8938c08255d0d50ef7b14b2ef13a00cbda035feb63a10fcd65ba This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in siska-gembus92-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 897ff3d6f030dbc420f7a563fcd7696ace211bfee7c1d684bf5c9227c856a051 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

kernel: ring-buffer: Validate the persistent meta data subbuf array

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Validate the persistent meta data subbuf array The meta data for a mapped ring buffer contains an array of indexes of all the subbuffers. The first entry is the reader page, and the rest of the entries lay out the...

Malicious code in helpless_salmon-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1d0094720ad284fc2ec0d2391240fd651ed89bdfee6a9ccf6b032953c691a03 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-95595 Malicious code in natural_blackbird_requirement (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 629ed979e3b01aa58c06d6b9379548119871e0e60c2eacd1c9219dbc51463553 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in joko-kue22-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5185215589098cb199e1a2d78df775792e9ed7b5e93ca8a5ae52c01b6d42a3f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-56542 Malicious code in gita-sroto90-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 218eb03406d5e23a4080b524f043bfd443bc4ec8a26da066e070c2c05071e9a6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

PT-2025-46242

CVE-2025-8768 - Apache Web Server Authentication Bypass CVE ID : CVE-2025-8768 Published : Nov. 10, 2025, 3:15 p.m. | 1 hour, 25 minutes ago Description : Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2025-12020. Reason: This candidate is a reservation duplicate of...

EUVD-2025-38210

EUVD-2025-38210...

PT-2025-45571

Name of the Vulnerable Software and Affected Versions ClipBucket versions 5.5.2 through 5.5.2-156 Description An authenticated regular user can create a photo collection with a collection name containing HTML/JavaScript payloads. This makes the Manage Photos feature susceptible to Stored Cross-Si...

EUVD-2025-38164

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in NetworksController.addNetworkAction that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information...

EUVD-2025-38170

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AppManagementController.appUpgradeAction that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information...

EUVD-2025-38171

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxDeviceFwRulesAction that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information...

EUVD-2025-38178

Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection vulnerability within the ‘data’ parameter to the ‘NetworkServlet’ endpoint. Successful exploitati...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990571)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990571 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dispnv04: fix null pointer dereference in nv17tvgethdmodes In nv17tvgethdmodes, the...

Security update for kernel-livepatch-MICRO-6-0_Update_11

This update for kernel-livepatch-MICRO-6-0Update11 fixes the following issues: CVE-2025-38664: ice: Fix a null pointer dereference in icecopyandinitpkg bsc1248631 CVE-2025-38678: nftables: reject duplicate device on updates bsc1249534 Patch Instructions: To install this SUSE update use the SUSE...

SUSE-SU-2025:20958-1 Security update for kernel-livepatch-MICRO-6-0_Update_11

This update for kernel-livepatch-MICRO-6-0Update11 fixes the following issues: - CVE-2025-38664: ice: Fix a null pointer dereference in icecopyandinitpkg bsc1248631 - CVE-2025-38678: nftables: reject duplicate device on updates bsc1249534...

EUVD-2025-37779

The Events Calendar plugin for WordPress is vulnerable to information disclosure in versions up to, and including, 6.15.9. The sysinfo REST endpoint compares the provided key to the stored opt-in key using a loose comparison, allowing unauthenticated attackers to send a boolean value and obtain t...