MAL-2025-57149 Malicious code in kiki-mendut70-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f653b9dbed47433e8223ff39d35480a439daf38bdd3e60f294ea73ee5c621f15 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in siska-gembus49-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5f6ad97907b6c0558c865bc8b6cbbbd79d7f9b201425043ee2d398ad4a596f3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in qori-empal47-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bad20da48e39bb4f2f84b27b85ff888502158ccd83a8be7ec33a56fc8affc104 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bayu-kue21-apidev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ade5353b6669b7c0ea30f259a409f11884cd7fc5deb8a79b3f2f1f3d3a6563cb The package bayu-kue21-apidev was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...

thunderbird: firefox: An OBJECT tag type attribute overrode browser behavior on web resources without a content-type

A flaw was found in Thunderbird and Firefox. The Mozilla Foundation's Security Advisory describes the following issue: A malicious page could have used the type attribute of an OBJECT tag to override the default browser behavior when encountering a web resource served without a content-type. This...

RHEL 8 : thunderbird (RHSA-2025:19942)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:19942 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: thunderbird: firefox: Memory safety bugs CVE-2025-11714...

RHEL 9 : thunderbird (RHSA-2025:19943)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:19943 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: thunderbird: firefox: Memory safety bugs CVE-2025-11714...

RHEL 9 : thunderbird (RHSA-2025:19944)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:19944 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: thunderbird: firefox: Memory safety bugs CVE-2025-11714...

RHEL 8 : thunderbird (RHSA-2025:19938)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:19938 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: thunderbird: firefox: Memory safety bugs CVE-2025-11714...

RHEL 8 : thunderbird (RHSA-2025:19941)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:19941 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: thunderbird: firefox: Memory safety bugs CVE-2025-11714...

MAL-2025-191895 Malicious code in testpurpleteaming (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e4cc49d59c07354a2817163d4e569b1f6d2e6cf17c5c7fb0135bc5feebdfea4e Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in testpurpleteaming (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e4cc49d59c07354a2817163d4e569b1f6d2e6cf17c5c7fb0135bc5feebdfea4e Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

CVE-2025-11271

The Easy Digital Downloads plugin for WordPress is vulnerable to Order Manipulation in all versions up to, and including, 3.5.2 due to an order verification bypass. The verification is unconditionally skipped when the POST body includes verificationoverride=1. Because this value is...

CVE-2025-11271 Easy Digital Download <= 3.5.2 - Insufficient Verification to Order Manipulation

The Easy Digital Downloads plugin for WordPress is vulnerable to Order Manipulation in all versions up to, and including, 3.5.2 due to an order verification bypass. The verification is unconditionally skipped when the POST body includes verificationoverride=1. Because this value is...

CVE-2025-11271 Easy Digital Download <= 3.5.2 - Insufficient Verification to Order Manipulation

The Easy Digital Downloads plugin for WordPress is vulnerable to Order Manipulation in all versions up to, and including, 3.5.2 due to an order verification bypass. The verification is unconditionally skipped when the POST body includes verificationoverride=1. Because this value is...

CVE-2025-11271

The CVE-2025-11271 entry concerns WordPress Easy Digital Downloads (EDD) plugin versions up to and including 3.5.2. The vulnerability is an order verification bypass: the POST parameter verification_override=1 causes the verification check to be skipped unconditionally, enabling an attacker to su...

CVE-2025-11271 Easy Digital Download <= 3.5.2 - Insufficient Verification to Order Manipulation

The Easy Digital Downloads plugin for WordPress is vulnerable to Order Manipulation in all versions up to, and including, 3.5.2 due to an order verification bypass. The verification is unconditionally skipped when the POST body includes verificationoverride=1. Because this value is...

PT-2025-45174

Name of the Vulnerable Software and Affected Versions Easy Digital Downloads versions up to and including 3.5.2 Description The Easy Digital Downloads plugin for WordPress has a flaw that allows manipulation of orders. This is due to a bypass in order verification, which occurs when the...

Liferay Portal 7.4.3.8 < 7.4.3.112 XSS

Reflected cross-site scripting XSS vulnerability in Language Override in Liferay Portal allows remote attackers to inject arbitrary web script or HTML via the comliferayportallanguageoverridewebinternalportletPLOPortletselectedLanguageId parameter. Note that Nessus has not tested for this issue b...

PT-2025-44994

Name of the Vulnerable Software and Affected Versions Cursor versions 1.7.23 and below Description Cursor, a code editor built for programming with AI, contains a flaw where a malicious agent can access sensitive files that should be protected by the cursorignore mechanism. An attacker, having...