CVE-2025-13781 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to modify instance-wide AI feature provider settings by exploiting missing authorization checks in GraphQL mutations...

CVE-2025-13781 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to modify instance-wide AI feature provider settings by exploiting missing authorization checks in GraphQL mutations...

CVE-2020-7964

An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their checkouts to any user ID and consequently leak user data e.g., name, address, and previous orders of any other customer...

PT-2026-1715

Name of the Vulnerable Software and Affected Versions GitLab EE versions 18.5 through 18.5.4 GitLab EE versions 18.6 through 18.6.2 GitLab EE versions 18.7 through 18.7.0 Description An authenticated user could modify instance-wide AI feature provider settings due to missing authorization checks ...

CVE-2019-12437

In SilverStripe through 4.3.3, the previous fix for SS-2018-007 does not completely mitigate the risk of CSRF in GraphQL mutations,...

American Fuzzy Lop plus plus 4.35c

Google's American Fuzzy Lop is a brute-force fuzzer coupled with an exceedingly simple but rock-solid instrumentation-guided genetic algorithm. afl++ is a superior fork to Google's afl. It has more speed, more and better mutations, more and better instrumentation, custom module support, etc...

BGPFuzz: Automated Configuration Fuzzing of the Border Gateway Protocol

Telecommunications networks rely on configurations to define routing behavior, especially in the Border Gateway Protocol BGP, where misconfigurations can lead to severe outages and security breaches, as demonstrated by the 2021 Facebook outage. Unlike existing approaches that rely on synthesis or...

Malicious code in kisut-difg-diguuota (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c372d417f73ef5a6d31e503317e96cb7fbe3e7b11d0c69b52ea4bded4d2bb20 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in poglymer-ogminmh-abafbbaga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 858d7f55123de7d134412cb22d9b24d3b9239e5cb8436a5f0017236fbc7c4739 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hereis-manuic-tauwaaaja (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78dc5d5e6a8e2a9cebe7296ede97d0814351bc309a2d3f55f69d418c0da64d81 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-171492 Malicious code in leecsa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10e6ae65dd31a686cfb0fb2e85b3e45a655b59e01241d2f23f19f2aef3a99917 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sabuda-muyu-bgagfaug (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92ab4b643cb19e67ba546c21d673a971f9ca17a7231ddfd4bdd166404ee1cb02 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-163201 Malicious code in nokire-nana47 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3deff3095daa2f04195a104e45620a9b032ddf321d56fc3440b9563688187c7b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-155766 Malicious code in hariyono-poke49 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 650ae41fafcbdbab23d114edef996ab26bc444ff801c0d5c6672238a2b575d9d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-157064 Malicious code in jimmy-poke1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3831f95f6c886a63b570e366399434ed2b8cf8018a6afa2a608df475098045b7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teagood-manaki9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f21eec2549c7a6f0bc74783df5574344010ac9195a55435d51b82d24bcd2a360 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-164824 Malicious code in rinto-poke51 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cb1eea4049ba0cae2bff72ce8e34c81b265fa6fa6643488ac5db94cf7fe2abb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-156857 Malicious code in iqbal-poke5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a61b5872719bd26942ed5d399a88e9dfca9ece1c6f0ae4e73ec074a1a974e743 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ursa-middleware-express-europa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba207fd9cd33feba39f2088ce036150bd5cfd54db1cbb8c7b108f8a6b527c224 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tania-bika49-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5837c7bc94e3824ee5d87e7afc63984550a9c7e3bd8c172e861b1167e6f7f896 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...