MAL-2025-94581 Malicious code in forthcoming_pike_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96d198cc7c592e34e410725aef4df2ff58c3d07769c6c12e61366a4204cc9a77 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-95791 Malicious code in original_wasp_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee1d3cbaf1d0933863c62459ff8b2d144369b91a1c7d82d65f5e7374c06cb793 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-93269 Malicious code in arrogant_cardinal_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fceab05bb9d4b993d603b74e45af407d25ce25a2849453da4a8178a62b74479 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-88077 Malicious code in lutfi-sambel36-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f00855837dda4b3a9ede9f260aa28a011a1092f28dcc1745539c58c7b5d161a3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-86651 Malicious code in indah-kue95-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e331f444978dd6c717af6a135a6980b62220ae01807c8807445efcd6f326afad This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-11999

The Add Multiple Marker plugin for WordPress is vulnerable to unauthorized modification of data to due to a missing capability check on the addmultiplemarkerresetmap and ammsavemapapi functions in all versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to upda...

MAL-2025-82430 Malicious code in xaver-kentang79-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35e7f1ac1a765710f2fc40d771e287f6b3c1853e47b11b86baf997358868a777 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-76240 Malicious code in wibowo-jamblang59-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 264c13d6e585c90e24549df58b490fcf5e30e2267212c581fa7d20ebc1ab7bea This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in opposite-lime-cheetah (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52ff88ebe00d3b5760aef3f55b9e96a7d2b1bafd325e83a41d9255bfe3a2fe98 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-68861 Malicious code in independent-silver-turtle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5146524a5491b8f8b5b0d7c09096983c8cad001e274ccbbf4cd31e4e6fa070d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

WordPress Shelf Planner plugin <= 2.7.0 - Missing Authorization to Unauthenticated Settings Update vulnerability

Missing Authorization to Unauthenticated Settings Update vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Shelf Planner versions = 2.7.0...

Malicious code in damaged_sheep_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5969346aa18fa96f43ced9a4499893613e2db1ae785053296165e1d84dfdd031 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Intel® Graphics Advisory

Summary: Potential security vulnerabilities for some Intel® Graphics software may allow escalation of privilege or denial of service. Intel is releasing software updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2025-32091 Description: Incorrect default...

SigTest Software Advisory

Summary: A potential security vulnerability in some SigTest software may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2025-22391 Description: Improper access control for some SigTest before version...

Intel® PROSet/Wireless WiFi Software Advisory

Summary: Potential security vulnerabilities for some Intel® PROSet/Wireless WiFi Software may allow denial of service. Intel is releasing software updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2025-35971 Description: Out-of-bounds write for some Intel®...

java-1.8.0-openjdk security update

1.8.0.472.b08-1.0.1 - Update to 8u472-b08 GA Orabug: 38571645 - Update release notes for 8u472-b08. - Drop local JDK-8339414 fix as this is now included upstream - Reset rpmrelease to 1 now there are no other RPM builds on RHEL 8 - Sync the copy of the portable specfile with the latest update -...

Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2025-20560)

The remote Oracle Linux 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-20560 advisory. 5.4.17-2136.347.6.1 - x86/vmscape: Warn when STIBP is disabled with SMT Pawan Gupta Orabug: 38343661 - x86/bugs: Move cpubugssmtupdate down Pawan Gupta...

Oracle Linux 9 : kernel (ELSA-2025-19930)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-19930 advisory. - x86/vmscape: Add old Intel CPUs to affected list Waiman Long RHEL-114270 CVE-2025-40300 - x86/vmscape: Warn when STIBP is disabled with SMT Waiman...

Publish Your Threat Models! the Benefits Far Outweigh the Dangers

Threat modeling has long guided software development work, and we consider how Public Threat Models PTM can convey useful security information to others. We list some early adopter precedents, explain the many benefits, address potential objections, and cite regulatory drivers. Internal threat...

RHEL 10 : vim (RHSA-2025:21015)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:21015 advisory. Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim path traversal CVE-2025-53906 vim: Vim path...