MAL-2025-141174 Malicious code in cosmiconfig-barnard-markdown-pdf-webdriver-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bf8ae7c3b97e5730c7960388b097334d80efc91837176e1b7c2388bf92756c7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144419 Malicious code in link-passport-prettier-plugin-markdown-commitizen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 997cbb9644d6e2a6ea49c021e47526c36a9c49d25715d531b0e999691733fd1a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146494 Malicious code in prettier-plugin-markdown-sails-process-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14cec4c47bf880dbc0312f699945952724a754541d14cd4729e60f73900dc187 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145338 Malicious code in nebula-config-markdown-wasat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49c6bb56c830026923822e235d12e26b0b1161dd573bb8c095196ba84cc9de38 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144356 Malicious code in levels-markdown-cli-cosmiconfig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a91e420dffdd3b632425f0ab36ce3acc96e1a91ca101b3bf8e554a24c98aa932 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144550 Malicious code in loopback-frontend-prettier-plugin-markdown-spectron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76ff5e2656ce3b451ff360f78a67acd91fc9c21a7247fe942f1717f1b59d72de This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147169 Malicious code in rehype-galaxy-hydra-prettier-plugin-markdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae515cabdd377dc8f6e72c0e9f506b2e5ea246dca2b7ee74d12443ed287d875f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146197 Malicious code in phoenix-json-markdown-triton (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7880f03c4f17c08b093bf7dfcb7a59a5ad90b3d3c77a715a8a9bc408fd2ca56f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147572 Malicious code in sadr-prettier-plugin-markdown-luna-playwright (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00bac4b9d3bf434baf33475c1ffc2c91e619ca223df411a0ba2579dedd4f6c4d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144691 Malicious code in markdown-pdf-frontend-rimraf-start (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d81956f1b9dd174b55f6d0b1296d2a4ae9ca30a4a82a3c848a5a3a4d3c331e03 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140846 Malicious code in colors-csrf-rollup-prettier-plugin-markdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3babf499c271300aba4371a713b8f0dd82c891ac406c074b37358bb570d29f3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Gitlab -- vulnerabilities

Gitlab reports: Cross-site scripting issue in k8s proxy impacts GitLab CE/EE Incorrect Authorization issue in workflows impacts GitLab EE Information Disclosure issue in GraphQL subscriptions impacts GitLab CE/EE Information Disclosure issue in access control impacts GitLab CE/EE Prompt Injection...

Reverse Tabnabbing Attacks

jupyterlab is vulnerable to Reverse Tabnabbing attacks. The vulnerability is due to missing the noopener attribute in links generated by LaTeX typesetters in Markdown cells and files, which allows an attacker to exploit links with target=blank to potentially hijack the originating browser tab...

ExploitReport

The Exploit Report — Portfolio React A single-page React si...

Improper Input Validation

@digitalocean/do-markdownit is vulnerable to Improper Input Validation. The vulnerability is due to the callout and fenceenvironment plugins using .includes substring matching when allowedClasses or allowedEnvironments are strings instead of arrays, which allows an attacker to bypass intended...

Security Bulletin: security vulnerabilities are addressed with IBM Business Automation Insights iFixes for October 2025.

Summary Security vulnerabilities are addressed with IBM Business Automation Insights 24.0.0-IF005 and 25.0.0-IF002. These vulnerabilities have been also addressed in 24.0.1-IF005. Vulnerability Details CVEID:CVE-2025-36091 DESCRIPTION: IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and...

CVE-2025-54384

CKAN is an open-source DMS data management system for powering data hubs and data portals. Prior to 2.10.9 and 2.11.4, the helpers.markdownextract function did not perform sufficient sanitization of input data before wrapping in an HTML literal element. This helper is used to render user-provided...

CVE-2025-54384

CKAN is an open-source DMS data management system for powering data hubs and data portals. Prior to 2.10.9 and 2.11.4, the helpers.markdownextract function did not perform sufficient sanitization of input data before wrapping in an HTML literal element. This helper is used to render user-provided...

Cross-site Scripting (XSS)

Overview ckan is a world’s leading Open Source data portal platform. It powers dozens of Open Data portals around the world, including data.gov, open.canada.ca and europeandataportal.eu but also regional, research and community organizations. It makes easy to publish, share and find data online a...

GHSA-2R4H-8JXV-W2J8 CKAN vulnerable to stored XSS in resource description

Impact The helpers.markdownextract function did not perform sufficient sanitization of input data before wrapping in an HTML literal element. This helper is used to render user-provided data on dataset, resource, organization or group pages plus any page provided by an extension that used that...