EUVD-2025-148002

Malicious code in tear-grass-rc npm...

Malicious code in tear-grsdas-rc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d08680c63d6dd5037040ea8bfce9dec930dda5ff1f067d7d7751a7ac7de95cb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-147998

Malicious code in tear-hfsips-rc npm...

EUVD-2025-148000

Malicious code in tear-grsass-rc npm...

MAL-2025-154181 Malicious code in dajouka-scelas-rc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d2f38a3449ea54ac9a292683799d52e4f9b6eb0bcdcfeb1e35e297d1477d765 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-147992

Malicious code in tear-rcbt-rc npm...

Malicious code in tear-slas-rc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aec940c8e6c7204eb4f93c58fa68cf01eb19e3dd74af78acbce4b397570c8a62 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dajouka-scelas-rc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d2f38a3449ea54ac9a292683799d52e4f9b6eb0bcdcfeb1e35e297d1477d765 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-147991

Malicious code in tear-sas-rc npm...

Malicious code in tear-grsass-rc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c0377406bb501ec4db1d72bc0638517db433489afb8d16925e2b42f1234bd0d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Important: Red Hat Bug Fix Advisory: .NET 10.0 bug fix and enhancement update

An update for .NET 10.0 is now available for Red Hat Enterprise Linux 9. Please updateBug Fixes and Enhancements: Update .NET 10 to RC 1 rhel-9.7.z JIRA:RHEL-114572 Update .NET 10 to RC 2 rhel-9.7.z JIRA:RHEL-121559 dotnet10.0: .NET Denial of Service Vulnerability rhel-9.7.z JIRA:RHEL-120623...

CVE-2025-64323

kgateway is a Cloud-Native API and AI Gateway. Versions 2.0.4 and below and 2.1.0-agw-cel-rbac through 2.1.0-rc.2 lack authentication, allowing any client with unrestricted network access to the xDS port to retrieve potentially sensitive configuration data including certificate data, backend...

CVE-2025-64323

kgateway is a Cloud-Native API and AI Gateway. Versions 2.0.4 and below and 2.1.0-agw-cel-rbac through 2.1.0-rc.2 lack authentication, allowing any client with unrestricted network access to the xDS port to retrieve potentially sensitive configuration data including certificate data, backend...

CVE-2025-52881 runc: LSM labels can be bypassed with malicious config using dummy procfs files

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts we have also verified thi...

CVE-2025-52881

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts we have also verified thi...

AZL-70592 CVE-2025-31133 affecting package kubernetes for versions less than 1.30.10-16

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform sufficient verification that the source of the bind-mount i.e., the container's /dev/null was...

CVE-2025-31133

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform sufficient verification that the source of the bind-mount i.e., the container's /dev/null was...

PT-2025-45383

Name of the Vulnerable Software and Affected Versions Zitadel versions 4.0.0-rc.1 through 4.6.2 Description Zitadel is an open source identity management platform susceptible to secure Direct Object Reference IDOR attacks through its V2Beta API. Authenticated users with specific administrator rol...

PT-2025-45375

Name of the Vulnerable Software and Affected Versions runc version 1.2.7 runc version 1.3.2 runc version 1.4.0-rc.2 Description runc is a CLI tool for spawning and running containers according to the OCI specification. A race condition exists that allows an attacker to trick the tool into...

VulnCheck KEV: CVE-2025-32429

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an...