Malicious code in eko-kripik76-riris (npm)

Source: amazon-inspector 3964ddab5e885e5be401055147832f3b696525abc5595c1384cf7c47fa728508 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eko-keripik89-breki (npm)

Source: amazon-inspector 87385458b61009cf4de4da4cbe88eaf41388557e6f089fa56d79ad23ec0cb1e2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eko-jengkol38-breki (npm)

Source: amazon-inspector e36718bcc2935d86e6b47a074631d2cde796954a24b9012e58b7547fe1a53aa3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eko-jus98-sluey (npm)

Source: amazon-inspector e77b54f4ec026b8c406b0c3f087cce22e54ce7c455824cdaa770e27f1da76eff This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eko-bubursumsum15-riris (npm)

Source: amazon-inspector 38e23c94eb44d0588d1c363b3ae0acc684b0c88e733de76bcdab7314a9af8699 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eko-bubur77-breki (npm)

Source: amazon-inspector ca7fc141c6e51c08954a494d1d6ac6935c1d51652b79eb289a0fb263891a440f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eko-bakso90-sukiwir (npm)

Source: amazon-inspector b4fa5bcf91247c43e08a30842aefa3877629df6b1d91dc6363d82d459a7ca89d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eka-tongseng54-breki (npm)

Source: amazon-inspector 10d27e30e35b0a3c90ffcf728f560671d63ef1a5a8fed4e15eb28ebb9817ff99 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eka-nasipecel56-breki (npm)

Source: amazon-inspector 2fdcac26219ac6de5fe290512c61998eb93a872399e83db078af48fd59c80b63 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eka-nasisayur56-sluey (npm)

Source: amazon-inspector d159681cb7b93081b952251a800f75b2d16717e776c9709803980bf6142e881c The package eka-nasisayur56-sluey was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded npm with over 15,000 spam packages in 2024. These...

Malicious code in eka-lutis7-riris (npm)

Source: amazon-inspector 8818813423499766961104cca2e3e4612aa51ad3a4b75ce965694acbc1a008f7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

CVE-2026-78083

Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property 4.1.4 - The visitor booking properties.booking and agent contact form submission agents.sendmail endpoints processed POST requests without verifying Joomla session...

CVE-2026-78084

Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property 4.1.4 - The gallery management controller tasks lacked authorization checks and CSRF token validation.. Users could invoke file removal actions with arbitrary path strings or upload unverified fi...

EUVD-2026-75386

Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension 2.3.0 - The front-end JSON editor endpoint exposes an action called contact that requires no authentication, no CSRF token, no captcha when no captcha plugin is enabled and has no rate limitin...

CVE-2026-78083 Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property < 4.1.4

Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property 4.1.4 - The visitor booking properties.booking and agent contact form submission agents.sendmail endpoints processed POST requests without verifying Joomla session...

CVE-2026-78084 Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4

Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property 4.1.4 - The gallery management controller tasks lacked authorization checks and CSRF token validation.. Users could invoke file removal actions with arbitrary path strings or upload unverified fi...

CVE-2026-78084

SP Property (a Joomla extension by joomshaper.com) versions below 4.1.4 contain a Missing Access Control vulnerability in the gallery image management controller. The affected controller tasks lacked authorization checks and CSRF token validation , allowing users to invoke file removal actions wi...

EUVD-2026-75392

Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property 4.1.4 - The gallery management controller tasks lacked authorization checks and CSRF token validation.. Users could invoke file removal actions with arbitrary path strings or upload unverified fi...

CVE-2026-78084 Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4

Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property 4.1.4 - The gallery management controller tasks lacked authorization checks and CSRF token validation.. Users could invoke file removal actions with arbitrary path strings or upload unverified fi...

hubzoid (>=0.7.15, <=0.9.6), openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-88002 via open-webui (>=0.6.0, <=0.11.0)

open-webui PYPI version =0.6.0, =0.7.15, =0.9.6 - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-88002 Source advisory: OSV:PYSEC-2026-3879...