Malicious code in cici-kupat54-wekto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4eb459b54723823225e2a1136546d59790c84d24a3119672fa5fee58b25d8d31 The package cici-kupat54-wekto was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...

Malicious code in eka-soto72-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b197dd6dd5c055e11ced4931bc4e9e97f1b6b7eb1dcc0cf101bceac5bef5aad The package eka-soto72-miaww was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded n...

Malicious code in candra-liwet89-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eeef79a7e90f98af6c4901ea83a19951b5fcc50b0365550bdb622fd4358995a6 The package candra-liwet89-riris was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flood...

MAL-2025-50080 Malicious code in cindy-asinan38-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2c67dc4fccd803586e002af7119cd3f3b22bcb14f067a2680747fb78a6e91dc The package cindy-asinan38-sluey was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flood...

MAL-2025-50323 Malicious code in erick-ketoprak66-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6622436ea0673ae30788dfbd52c59e875e75ceb1699f103cd651b2e19ee16e6 The package erick-ketoprak66-miaww was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

MAL-2025-50180 Malicious code in dewanto-enting100-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a665fc58c92a7ac5c3b63c273561383f8235b8a8218dc161ba9e385f0a261efd The package dewanto-enting100-sukiwir was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

MAL-2025-51155 Malicious code in budi-semur26-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffc7f92f061e0e4e0de68062aeb3b7309c7b218d3f436169c230e9dd1373276e The package budi-semur26-miaww was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...

MAL-2025-52687 Malicious code in wati-semur63-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c229d8d2214182c68f2aff76db6656d6a896896a2741067063e04255f8c3eae8 The package wati-semur63-sluey was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...

Malicious code in candra-lapis15-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1574ace7d6a697b79146e74c59fa2fe57fa258525c19779e76388aa707281e6 The package candra-lapis15-miaww was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flood...

kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy

In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfsmdtdestroy In allocinode, inodeinitalways could return -ENOMEM if securityinodealloc fails, which causes inode-iprivate uninitialized. Then nilfsismetadatafileinode returns true and nilfsfreeinode...

PT-2025-46215

Name of the Vulnerable Software and Affected Versions Soft Serve versions prior to 0.11.1 Description Soft Serve, a self-hostable Git server, contains a Server-Side Request Forgery SSRF issue. The application does not validate webhook URLs, which allows repository administrators to create webhook...

Updated xen packages fix security vulnerabilities

Double unlock in x86 guest IRQ handling. CVE-2024-31143 Xapi: Metadata injection attack against backup/restore functionality. CVE-2024-31144 Error handling in x86 IOMMU identity mapping. CVE-2024-31145 PCI device pass-through with shared resources. CVE-2024-31146 x86: Deadlock in vlapicerror...

SUSE CVE-2025-41443

Mattermost versions 10.5.x = 10.5.12, 10.11.x = 10.11.2 fail to properly validate guest user permissions when accessing channel information which allows guest users to discover active public channels and their metadata via the /api/v4/teams/teamid/channels/ids endpoint...

EUVD-2025-38345

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. In versions 8.6.0 through 8.9.0, there is an authenticated, blind time-based SQL-injection inside the appMetadata-operation of the GraphQL-API. This allows extraction of arbitrary data from the...

CVE-2025-64493 SuiteCRM is Vulnerable to Authenticated Blind SQL Injection via GraphQL

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. In versions 8.6.0 through 8.9.0, there is an authenticated, blind time-based SQL-injection inside the appMetadata-operation of the GraphQL-API. This allows extraction of arbitrary data from the...

CVE-2025-64493 SuiteCRM is Vulnerable to Authenticated Blind SQL Injection via GraphQL

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. In versions 8.6.0 through 8.9.0, there is an authenticated, blind time-based SQL-injection inside the appMetadata-operation of the GraphQL-API. This allows extraction of arbitrary data from the...

CVE-2025-64493

In SuiteCRM versions 8.6.0–8.9.0, an authenticated, blind (time-based) SQL injection exists in the appMetadata operation of the GraphQL API, allowing extraction of arbitrary data without admin access. Affected component: GraphQL API, operation appMetadata. Root cause: improper handling/validation...

[SECURITY] Fedora 43 Update: luksmeta-10-1.fc43

LUKSMeta is a command line utility for storing small portions of metadata in the LUKSv1 header for use before unlocking the volume...

Fedora 43 : luksmeta (2025-e53e8fdc0a)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-e53e8fdc0a advisory. Fix handling of large metadata Fix: CVE-2025-11568 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note tha...

Faking Receipts with AI

Over the past few decades, it's become easier and easier to create fake receipts. Decades ago, it required special paper and printers--I remember a company in the UK advertising its services to people trying to cover up their affairs. Then, receipts became computerized, and faking them required...