MAL-2025-97321 Malicious code in wasteful_pike_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fadb125bd22137aef9a53d09dc8d6b0dc8fad2bdd359abea4c5cd9ed697d7252 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-82603 Malicious code in youngest_tick_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 704cc6a439f941a09e86050281ebbcc2eea49631e23051c0a4f842132d476b73 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-11986 Crypto Tool <= 2.22 - Unauthenticated Information Exposure via Global Authentication State

The Crypto plugin for WordPress is vulnerable to Information exposure in all versions up to, and including, 2.22. This is due to the plugin registering an unauthenticated AJAX action wpajaxnoprivcryptoconnectajaxprocess that allows calling the register and savenft methods with only a...

CVE-2025-11986

CVE-2025-11986 affects the WordPress Crypto Tool plugin (

CVE-2025-11988

The CVE-2025-11988 entry concerns the WordPress Crypto Tool plugin (versions

CVE-2025-11988 Crypto Tool <= 2.22 - Missing Authentication to Unauthenticated Limited File Deletion

The Crypto plugin for WordPress is vulnerable to unauthorized manipulation of data in all versions up to, and including, 2.22. This is due to the plugin registering an unauthenticated AJAX action wpajaxnoprivcryptoconnectajaxprocess that allows calling the cryptodeletejson method with only a...

Malicious code in bayu-taiwan57-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5990eb43fd0a5159cda2c2f7ebf5d148c6eee599e3b1a690df6bb47865bea537 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Intel OFU 安全漏洞

Intel OFU is a flash update application from Intel Corporation USA. A security vulnerability exists in Intel OFU versions prior to 14.1.31, which stems from improperly set default permissions and could result in elevated privileges...

RHEL 10 : podman (RHSA-2025:20983)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:20983 advisory. The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use...

Bitdefender Endpoint Security Tool 安全漏洞

Bitdefender Endpoint Security Tool is an endpoint security management tool from the Romanian company Bitdefender. A security vulnerability exists in versions prior to Bitdefender Endpoint Security Tool 7.20.52.200087, which stems from improperly restricting folder access and could allow a...

ROS-20251111-10

Vulnerability of processsymtab function of eu-readelf component of ELF Elfutils binary modification and analysis utility is related to copying buffer without checking input data size. ELF Elfutils is related to buffer copying without checking input data size. Exploitation vulnerability could allo...

WordPress Crypto Tool plugin <= 2.22 - Unauthenticated Information Exposure via Global Authentication State vulnerability

Unauthenticated Information Exposure via Global Authentication State vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Crypto versions = 2.22...

WordPress Crypto Tool plugin <= 2.22 - Missing Authentication to Unauthenticated Limited File Deletion vulnerability

Missing Authentication to Unauthenticated Limited File Deletion vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Crypto versions = 2.22...

Hackers Exploiting Triofox Flaw to Install Remote Access Tools via Antivirus Feature

Google's Mandiant Threat Defense on Monday said it discovered n-day exploitation of a now-patched security flaw in Gladinet's Triofox file-sharing and remote access platform. The critical vulnerability, tracked as CVE-2025-12480 CVSS score: 9.1, allows an attacker to bypass authentication and...

Malicious code in nadia-nasi33-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2271968d160204312c6779dc75a6d900cca7185f9fe4e18b4a613dee70a2d017 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-44050

In JetBrains YouTrack before 2025.3.104432 improper access control allowed modify MCP tool logic...

CVE-2025-64687

...

CVE-2025-64687

Summary : JetBrains YouTrack prior to version 2025.3.104432 is affected by an improper access control issue that can allow modification of MCP tool logic. This vulnerability is described across multiple sources (Red Hat, ENISA EUVD, CIRCL/CVE sightings, CNNVD, and others) and specifically impacts...

Malicious code in dian-tapai77-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f95259dafb41e84ec9f9f031746bc1e243f93a43df0bedf39e1d384df7988aca The package dian-tapai77-breki was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...

编号撤回

JetBrains YouTrack is a browser-based bug tracking and project management software from the Czech company JetBrains. The software features bug tracking, creating workflows and monitoring project progress. A security vulnerability exists in versions prior to JetBrains YouTrack 2025.3.104432, which...