EUVD-2025-122166

Malicious code in sedna-carpo-yaml-server npm...

EUVD-2025-114751

Malicious code in csv-sedna-epimetheus-yaml npm...

EUVD-2025-111738

Malicious code in library-fornax-start-yaml npm...

EUVD-2025-111745

Malicious code in levels-yaml-build-shelljs npm...

EUVD-2025-113913

Malicious code in eslint-config-europa-yaml-triton npm...

EUVD-2025-112068

Malicious code in juno-yaml-neptune-node-config npm...

EUVD-2025-114832

Malicious code in cross-env-yaml-meteor-aurora npm...

EUVD-2025-121006

Malicious code in umbra-meissa-yaml-radiant npm...

Malicious code in cross-env-yaml-meteor-aurora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20d215441ec813faf80ea353ec77a212352b199912065942b6bb274f8b4c5103 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-124021

Malicious code in ora-yaml-yildun-node-sass npm...

EUVD-2025-123494

Malicious code in postcss-yaml-lynx-build npm...

EUVD-2025-122219

Malicious code in scorpius-browserify-yaml-eris npm...

MAL-2025-147757 Malicious code in sedna-carpo-yaml-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b7c4c234095f395661d4444c8c4bcc25c5188dc121201acf2d56d355773a35a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146527 Malicious code in prettier-yaml-commitlint-kinetic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84197f8f3211ebef49ce9b3018f98351e783404d7aee0a1de774671d75066fa7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pulsar-html-webpack-plugin-yaml-passport (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de284ef22c3d79d0eb08d849bacc79b6b331418af35f35cdf63627b30baba057 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-64232 WordPress Import from YML plugin <= 3.1.17 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in icopydoc Import from YML import-from-yml allows Reflected XSS.This issue affects Import from YML: from n/a through = 3.1.17...

CLSA-2025-1762422500 toolbox: Fix of CVE-2022-3064

CVE-2022-3064: prevent excessive CPU and memory consumption when parsing YAML documents...

PT-2025-45336

Name of the Vulnerable Software and Affected Versions Import from YML versions through 3.1.17 Description An issue exists in the Import from YML plugin that allows for Reflected Cross-site Scripting XSS. The issue is due to improper neutralization of input during web page generation...

CVE-2025-52472

creationtimestamp| type| source ---|---|--- 2025-11-03 04:08:11+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-52472.yaml 2025-11-03 21:02:29+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3m4qw67lswh26 2025-11-04...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 / 25.10 : YAML::Syck vulnerability (USN-7844-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 / 25.10 host has a package installed that is affected by a vulnerability as referenced in the USN-7844-1 advisory. It was discovered that YAML::Syck did not properly handle parsing YAML files. An attacker could...