MAL-2025-79612 Malicious code in limited_kiwi_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95a624c048453d7039228ee1f997f06659385942d7bf6b3f8d8c5a0879f565d3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in limited-teal-octopus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e79fc50aa53fc45d1bf4dfd833fdf03d952aa6aae7aaa5f8148be5477039b4c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-53486

Malicious code in limited-amber-elephant npm...

EUVD-2025-53484

Malicious code in limited-teal-octopus npm...

EUVD-2025-53485

Malicious code in limited-coffee-crawdad npm...

MAL-2025-64000 Malicious code in limited_constrictor_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b04249bb4b45f80fa366c658cd294a6bd4136b47f25e0f1673990203d1d0dda This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-58639

Malicious code in limitedconstrictorz3n npm...

WordPress Crypto Tool plugin <= 2.22 - Missing Authentication to Unauthenticated Limited File Deletion vulnerability

Missing Authentication to Unauthenticated Limited File Deletion vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Crypto versions = 2.22...

CVE-2025-9334

The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 1.7.7. This is due to insufficient input validation and restriction on the 'rtafarajax' function. This makes it possible for authenticated...

CVE-2025-43421

Multiple issues were addressed by disabling array allocation sinking. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash...

CVE-2025-10008 Translate WordPress and go Multilingual – Weglot <= 5.1 - Missing Authorization to Unauthenticated Limited Transient Deletion

The Translate WordPress and go Multilingual – Weglot plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'cleanoptions' function in all versions up to, and including, 5.1. This makes it possible for unauthenticated attackers to delete limited...

Arista DANZ Monitoring Fabric 安全漏洞

Arista DANZ Monitoring Fabric is a traffic monitoring, security, and performance analytics platform from Arista USA. A security vulnerability exists in Arista DANZ Monitoring Fabric that originates from a restricted user being able to view sensitive portions of the configuration database via the...

VulnCheck KEV: CVE-2025-54251

Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an XML Injection vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to manipulate XML queries and gain limited unauthorized write access...

CVE-2025-47699

Exposure of Sensitive System Information to an Unauthorized Control Sphere CWE-497 in the Gallagher Morpho integration could allow an authenticated operator with limited site permissions to make critical changes to local Morpho devices. This issue affects Command Centre Server: 9.30 prior to...

Incorrect Authorization

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Incorrect Authorization due to the insufficient enrolment validation in quiz notifications. An attacker can obtain limited course information by receiving quiz-related messages intended for active...

CVE-2025-62394 Moodle: quiz notifications sent to suspended participants

Moodle failed to verify enrolment status correctly when sending quiz notifications. As a result, suspended or inactive users might receive quiz-related messages, leaking limited course information...

CVE-2025-47699

Exposure of Sensitive System Information to an Unauthorized Control Sphere CWE-497 in the Gallagher Morpho integration could allow an authenticated operator with limited site permissions to make critical changes to local Morpho devices. This issue affects Command Centre Server: 9.30 prior to...

CVE-2025-47699

Exposure of Sensitive System Information to an Unauthorized Control Sphere CWE-497 in the Gallagher Morpho integration could allow an authenticated operator with limited site permissions to make critical changes to local Morpho devices. This issue affects Command Centre Server: 9.30 prior to...

CVE-2025-47699

CVE-2025-47699 affects Gallagher Command Centre Server via the Morpho integration. Root cause: Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497). Affected versions: 9.30 before 9.30.2482 (MR2), 9.20 before 9.20.2819 (MR4), 9.10 before 9.10.3672 (MR7), 9.00 befor...

CVE-2025-61750

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Query. Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTool...