EUVD-2025-112030

Malicious code in jwt-publish-hermes-miranda npm...

EUVD-2025-123873

Malicious code in pegasus-redis-jwt-semantic-ui npm...

EUVD-2025-116533

Malicious code in arcturus-fork-cassini-jwt npm...

EUVD-2025-112021

Malicious code in jwt-wolf-solis-query npm...

Malicious code in pegasus-redis-jwt-semantic-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 029211974165cff66e42351cf6175e104e89284a986f021fc112f1c0b00c02c5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-120937

Malicious code in update-chai-non-blocking-jwt npm...

EUVD-2025-115684

Malicious code in carina-resolvers-jwt-xo npm...

Malicious code in jwt-publish-hermes-miranda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector faed0d9ac5f74a79bcc66d9aaa67b60d041eebe36f6287a5dd01a2cc9ff9c830 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-112025

Malicious code in jwt-test-elektra-sails npm...

EUVD-2025-112038

Malicious code in jwt-gravity-europa-hexo npm...

Malicious code in jwt-leda-framework-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bb4f8cb8d4f557c3034d71e7ecaf0ff765c06e1a8805438ce959a7d22ca3637 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-113439

Malicious code in foundation-sync-jwt-dependencies npm...

MAL-2025-144070 Malicious code in jwt-bulma-private-passport (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6440b82a3e373f0f05f339f463a887f1b1c5f60136c927d1d72f65b011de2bf1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-64386

The equipment grants a JWT token for each connection in the timeline, but during an active valid session, a hijacking of the token can be done. This will allow an attacker with the token modify parameters of security, access or even steal the session without the legitimate and active session...

CVE-2025-64386 HIJACKING OF THE TOKEN AND GAINING ACCESS

The equipment grants a JWT token for each connection in the timeline, but during an active valid session, a hijacking of the token can be done. This will allow an attacker with the token modify parameters of security, access or even steal the session without the legitimate and active session...

Circutor TCPRS1plus 安全漏洞

Circutor TCPRS1plus is a communication converter from Circutor Spain. A security vulnerability exists in Circutor TCPRS1plus that stems from a web server that allows an attacker to reuse old JWT tokens during legitimate session activity, potentially leading to session hijacking and security...

CVE-2025-11760

The eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams plugin for WordPress is vulnerable to exposure of sensitive information in all versions up to, and including, 1.5.6. This is due to the plugin exposing Zoom SDK secret keys in client-side JavaScript within the meeting vie...

CVE-2025-11760

CVE-2025-11760 affects the WordPress plugin “eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams” through version 1.5.6. The root cause is exposure of the Zoom SDK secret keys in client-side JavaScript in the meeting view template, enabling unauthenticated attackers to extract...

Security Bulletin: vulerability in IBM Spectrum Symphony with Nimbus JOSE + JWT

Summary vulerability in IBM Spectrum Symphony with Nimbus JOSE + JWT Vulnerability Details CVEID:CVE-2025-53864 DESCRIPTION: Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in...

CVE-2025-62610

Hono is a Web application framework that provides support for any JavaScript runtime. In versions from 1.1.0 to before 4.10.2, Hono’s JWT Auth Middleware does not provide a built-in aud Audience verification option, which can cause confused-deputy / token-mix-up issues: an API may accept a valid...