Malicious code in eka-kemplang6-riris (npm)

Source: amazon-inspector 1f1188f27a13f5ec8f5ee6b4414a72af1b85159e4b541236346fa3ddc7dc0dbc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eka-kembang12-sluey (npm)

Source: amazon-inspector ea3f762936eee9c76b848b301d54e4e363bce525059ffadc3cf657e0d420ed3b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eka-kacang5-sluey (npm)

Source: amazon-inspector 0f91285a61f57179c9d89229ee173ac323c9747b132ba8974d3248ae5d0bc481 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eka-gulai27-miaww (npm)

Source: amazon-inspector d1670d4cc8e07a09e409749df602a2ebc6f86c459cef1cdf49eb2d6e8bb245d1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eka-gorengan73-breki (npm)

Source: amazon-inspector b4dd91ea12954934ceca1cf38cafe47ecd9e5751ab78acc07ee69ccad55e6faf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eka-jamblang23-breki (npm)

Source: amazon-inspector 9d60c6097b42c08f3288c66be826adb7bb0a6be568ae173661339245ad161995 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eka-gudeg98-breki (npm)

Source: amazon-inspector 38d9a7cb559e042b5e733875e7586880d190a6db914f523c0f354df2e160a2b9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eka-gulai21-miaww (npm)

Source: amazon-inspector 4e4c261f6564beff2ae8939a75dfc2aa2b8785399ff1f52944e7defd26aa3ad4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eka-gepuk46-breki (npm)

Source: amazon-inspector 5932686a1e5548f4657fdb896122c61017c9e93b388f7ed77453a1997ab779c3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eka-gorengan18-miaww (npm)

Source: amazon-inspector 3ebb9ff045347ddba5de434f71fc161c4026453f919ef0ebedf8e827b414d583 The package eka-gorengan18-miaww was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded npm with over 15,000 spam packages in 2024. These...

Malicious code in eka-gudeg44-sukiwir (npm)

Source: amazon-inspector f4dadc684394dc58c219eaa5a213f0daba239b64c9de3ee06e489b3fccf5b11b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eka-gembus49-miaww (npm)

Source: amazon-inspector 51a290b52a939a3ee0a45fdf535bb5c245a12364047c1268a8ed8086dc7d61f8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eka-gaplek76-sluey (npm)

Source: amazon-inspector fa768bdee917ea1483a7dde6adaf2ffe4b77b1843c6836646bb07576a513081a The package eka-gaplek76-sluey was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded npm with over 15,000 spam packages in 2024. These package...

Malicious code in eka-gado-gado56-sukiwir (npm)

Source: amazon-inspector df587debd24337f80e344b782d31db9f8966a090eb92f030e2e2c59c20fb5aa8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

PYSEC-2026-3813 ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection

A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to...

SQL Injection

Apache Hive is vulnerable to SQL Injection. The vulnerability is due to unsanitized partition names being concatenated into direct SQL queries, allowing an authenticated user to alter partition lookups and read, modify, truncate, or affect unintended partition metadata...

CVE-2026-15823

The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable function in versions up to, and including, 3.0.2. The wpajaxbacheetahdisable AJAX handler is registered without any capability or nonce...

CVE-2026-15823 Builderall for WordPress <= 3.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'ba_cheetah_data[post_id]' Parameter

The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable function in versions up to, and including, 3.0.2. The wpajaxbacheetahdisable AJAX handler is registered without any capability or nonce...

CVE-2026-15823

The Builderall Cheetah For Wp WordPress plugin (versions ≤ 3.0.2 ) contains a missing authorization flaw in the wp_ajax_ba_cheetah_disable AJAX handler. The disable() function is registered without a capability or nonce check, and the target post ID is read directly from user-controlled $_POST['b...

EUVD-2026-75236

The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable function in versions up to, and including, 3.0.2. The wpajaxbacheetahdisable AJAX handler is registered without any capability or nonce...