Malicious code in ember-addon-with-dependencies (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 030efb54b3c7ce3807868d73f64d415effba5c936da7b4fad9b37a7e184fbff7 The package ember-addon-with-dependencies was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in ida-brongkos75-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c89be3f058209a45605990dba1d51746a0bd0d5a1782c273bd976440658ccc14 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mahesa-gulai91-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8588b3eb9d741fa24c3851937e704b5f5d25a0de4e137d0a4723e560e80e89e4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cindy-tempe90-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 856e09c9bb2381957a87228617153873e9465fc071799160b4d47f9ecce623db This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-60907 Malicious code in naked_antelope_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ba6921e31ea1c7de66c574e7056b9ab2f77b31ca235d6dbe74e82272cb3d9ca This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-60633 Malicious code in icy_orca_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26d7b07f7af2426cee46e457ddd63f4c2ca0a6a957b657b101e41ec2d323238c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fajar-kemplang78-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a26f5ba393254cbd249e3d2e0da3ea46b069a97f365af1555041d14cbbae5b04 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-57260 Malicious code in kurniawan-ketan69-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cdb430549da25a589f59482a419fe13450857b9a5a8f8c9f717d0ccab332ba1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-55669 Malicious code in clean_gibbon_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b50f517d4f5774e28e52fbcd37dc73dc5938aba664582797d500738894f0bcdd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sinta-kue52-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60afc107b0512e2f701e01207e3bfca50ce59b0fcfb53bd826d8355034fdc19a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-53020 Malicious code in joko-oncom33-tititugel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 876d9917443450503834fe62bf839123776c0d5477a02cb86abffb73967e2470 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-11972: Improper Neutralization of Special Elements used in an SQL Command

The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to SQL Injection via the 'posttypes' parameter in all versions up to, and including, 3.40.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2025-63639: Improper Neutralization of Input During Web Page Generation

The chat feature in the application Sourcecodester FAQ Bot with AI Assistant v1.0 is vulnerable to Cross-Site Scripting XSS due to improper handling of user-supplied input. An attacker can inject malicious HTML or JavaScript into chat messages, which executes in the browser of any user viewing th...

CVE-2025-33110

CVE-2025-33110 affects IBM OpenPages 9.1 and 9.0 with Watson. The issue is HTML injection in the UI, allowing a remote attacker to inject HTML that runs in the victim’s browser within the hosting site’s security context. IBM’s bulletin confirms affected versions and lists fixes: 9.1.2 for 9.1 and...

CVE-2025-47588: Improper Control of Generation of Code

Improper Control of Generation of Code 'Code Injection' vulnerability in acowebs Dynamic Pricing With Discount Rules for WooCommerce aco-woo-dynamic-pricing allows Code Injection.This issue affects Dynamic Pricing With Discount Rules for WooCommerce: from n/a through = 4.5.9...

CVE-2025-58972: Path Traversal: '.../...//'

Path Traversal: '.../...//' vulnerability in Dmitry V. CEO of "UKR Solution" Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders allows Path Traversal.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through =...

CVE-2025-62039: Insertion of Sensitive Information Into Sent Data

Insertion of Sensitive Information Into Sent Data vulnerability in Ays Pro AI ChatBot with ChatGPT and Content Generator by AYS ays-chatgpt-assistant allows Retrieve Embedded Sensitive Data.This issue affects AI ChatBot with ChatGPT and Content Generator by AYS: from n/a through = 2.6.6...

Ransomware Defense Using the Wazuh Open Source Platform

Ransomware is malicious software designed to block access to a computer system or encrypt data until a ransom is paid. This cyberattack is one of the most prevalent and damaging threats in the digital landscape, affecting individuals, businesses, and critical infrastructure worldwide. A ransomwar...

go-jose: Go JOSE's Parsing Vulnerable to Denial of Service

A flaw was found in GO-JOSE. In affected versions, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code uses strings.Splittoken, "." to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large numb...

Malicious code in pkg-with-optional (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a7273cf1aeda44bb1d1c2b9e1336bae21d1e1c6606ec940757a218d7761a81b The package pkg-with-optional was found to contain malicious code. Source: ossf-package-analysis...