Malicious code in okta-mangut80-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b482657438e4f5ef07e4d07cb52516ecb25494da2d45603b2ecbba8b15e4512 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-54953 Malicious code in surya-asinan68-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a13912e2ac5d402cdd44926c9a1b55564b9cce300cf9952bbc29edc2f890f45 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in maman-ruwet47-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e493adc577402181413a0ddd564e5c073bf52706e45c84225c1524638b303eac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in maman-ongol-ongol19-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0bcf86a212d086df859c6a2871433322bcefcd17547bf27409c127fdf8631c9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-53548 Malicious code in nurul-lontong95-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b39984e65f3d257ba34cc81f79a07b7c54de3d730c31e6ed51ea19986fbf7f1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-53586 Malicious code in ocha-esdoger69-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d8e6d242e40d12f8905e0b9dd1849ccd1caa9cb4388b615d384e041e1c323d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in andi-telur75-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d408bbda31e701242e81908eff0db91759ce5a4d1ccd185344d6e762c399994 The package andi-telur75-ruro was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...

Malicious code in udin-lontong47-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ce0856581fc21c748ac7d25d0a6f25cf8f469f3e2fbda9a5e73460492436ce0 The package udin-lontong47-breki was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flood...

MAL-2025-52378 Malicious code in tania-kue42-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 887b1d469f90ed779f56e9911db5752904a07e644da7bdf05946d01836f30a3a The package tania-kue42-breki was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...

MAL-2025-52689 Malicious code in wati-teh84-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9cf67d7fe693dae9df6160fe5e6170d90995c6e5991d82190db81ea6dfd123d The package wati-teh84-breki was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded n...

CVE-2025-64177

ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, there is a stored Cross-Site Scripting XSS vulnerability in the dashboard, which can exploited when a user clicks on a malicious bookmark, made vulnerable by the lack of scheme...

CVE-2025-64177

ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, there is a stored Cross-Site Scripting XSS vulnerability in the dashboard, which can exploited when a user clicks on a malicious bookmark, made vulnerable by the lack of scheme...

PT-2025-45385

Name of the Vulnerable Software and Affected Versions ThinkDashboard versions prior to 0.6.8 Description ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. A stored Cross-Site Scripting XSS issue exists in the dashboard for versions 0.6.7 and below due to a...

CVE-2025-64177: Improper Neutralization of Input During Web Page Generation

ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, there is a stored Cross-Site Scripting XSS vulnerability in the dashboard, which can exploited when a user clicks on a malicious bookmark, made vulnerable by the lack of scheme...

Path Traversal

esm.sh is vulnerable to Path Traversal. The vulnerability is due to improper sanitization of user-supplied URL components allowing path-traversal and file-scheme requests by which an attacker can craft specially-formed requests that cause the server to read and return arbitrary local files or oth...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: A failure to properly deallocate memory buffers when writing to free old damonsysfsschemefilter-memcgpath. The memcgpathstore function assigns a newly allocated memory buffer to filter-memcgpath, without...

OESA-2025-2545 qt5-qtbase security update

Qt is a software toolkit for developing applications. Security Fixes: An issue was found in the private API function qDecodeDataUrl in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code. If the function was called with malformed data, for example, an URL that...

Security Bulletin: IBM QRadar Hub for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM QRadar Hub for IBM QRadar SIEM has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2025-58754 DESCRIPTION: Axios is a promise based HTTP clien...

PT-2025-45700

Summary When using subrequest authentication, Anubis did not perform validation of the redirect URL and redirects user to any URL scheme. While most modern browsers do not allow a redirect to javascript: URLs, it could still trigger dangerous behavior in some cases. GET...

A Comparative Study of Hybrid Post-Quantum Cryptographic X.509 Certificate Schemes

As quantum computing hardware continues to advance, the integration of such technology with quantum algorithms is anticipated to enable the decryption of ciphertexts produced by RSA and Elliptic Curve Cryptography ECC within polynomial time. In response to this emerging threat, the U.S. National...