org.keycloak/keycloak-services: WebAuthn Attestation Statement Verification Bypass

A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even when the realm is configured to require...

Malicious code in nudela-gagagaafh0afhf-gafsafoai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33516ad4a113964856f6c06a665cbe2e246314ec3c4b12d251a54fb95ad87161 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

bind: Cache poisoning attacks with unsolicited RRs

A vulnerability exists in BIND’s DNS resolver logic that makes it overly permissive when accepting resource records RRs in responses. Under certain conditions, this flaw allows attackers to inject unsolicited or forged DNS records into the cache. This can be exploited to poison the resolver cache...

CVE-2025-37734

Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant...

CVE-2025-37734 Kibana Origin Validation Error

Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant...

EUVD-2025-124976

Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant...

CVE-2025-37734

CVE-2025-37734 describes an Origin Validation Error in Kibana that can enable Server-Side Request Forgery when a forged Origin header is processed by the Observability AI Assistant. Publicly cited details indicate affected Kibana versions include 8.12.x prior to 8.19.7, 9.1.x prior to 9.1.7, and ...

Origin Validation Error

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Origin Validation Error via improper validation of the Origin HTTP header in the Observability AI Assistant. An attacker can make...

CVE-2025-37734 Kibana Origin Validation Error

Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant...

EUVD-2025-119996

The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing nonce validation on the setsubscriptionlevel function. This makes it possible for unauthenticated attackers to modify the subscription settings of...

MAL-2025-146298 Malicious code in pm2-grus-castor-hermes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b01596d797dab056c781ca726c1f03fc07bec0ea69821410f74259d0a63bcf5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in got-release-it-nodemon-callisto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2424016c8ee5e47eacbc475dc2f28d025a81a82cbae0be1a60689f3d65c1ba49 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phoebe-link-changelog-rollup-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fed773ad62f38e8f3bd74b0c9bcaf7640090adafd10937effed4cce88d7a9c8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-12588

The USB Qr Code Scanner For Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation on the settings page. This makes it possible for unauthenticated attackers to update the plugin's settings...

CVE-2025-12590

The YSlider plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 1.1. This is due to missing nonce verification on the content configuration page and insufficient input sanitization and output escaping. This makes it...

Malicious code in nadia-sate72-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88682ccc2a1c1f7d76276edeb8462baaa54d0ca956b68518ad952dca33086f61 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eka-rangi27-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0dc55ce91f6aa152c0bf5f194ab237109277e4823daf5fefa327846d2b46ef6f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-127939 Malicious code in kresna-enting53-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 843b56b025b69a0a70e42605ff9a63bc1478139f460e808e89babe67102c5513 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

bind: Cache poisoning attacks with unsolicited RRs

A vulnerability exists in BIND’s DNS resolver logic that makes it overly permissive when accepting resource records RRs in responses. Under certain conditions, this flaw allows attackers to inject unsolicited or forged DNS records into the cache. This can be exploited to poison the resolver cache...

Malicious code in armed_zebra_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d47802a2523b4382fe78f8957b90c3d5cb031a0c3a4dc51171428532bf3fddd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...