CVE-2025-43519

This CVE (CVE-2025-43519) concerns a permissions issue in macOS that could allow an app to access sensitive user data. Concrete details in connected docs show fixes are included in macOS Tahoe 26.2, macOS Sequoia 15.7.3, and macOS Sonoma 14.8.3. The issue is addressed by these OS updates; no expl...

PT-2025-51912

Name of the Vulnerable Software and Affected Versions visionOS versions prior to 26.2 iOS versions prior to 26.2 iPadOS versions prior to 26.2 watchOS versions prior to 26.2 macOS versions prior to Tahoe 26.2 Description An issue involving insufficient permissions restrictions was identified. Thi...

PT-2025-51899

Name of the Vulnerable Software and Affected Versions visionOS versions prior to 26.2 iOS versions prior to 26.2 iPadOS versions prior to 26.2 macOS versions prior to Tahoe 26.2 Description A configuration issue allowed unauthorized viewing of photos within the Hidden Photos Album. This issue was...

UBUNTU-CVE-2025-2486

The Ubuntu edk2 UEFI firmware packages accidentally allowed the UEFI Shell to be accessed in Secure Boot environments, possibly allowing bypass of Secure Boot constraints. Versions 2024.05-2ubuntu0.3 and 2024.02-2ubuntu0.3 disable the Shell. Some previous versions inserted a secure-boot-based...

Malicious code in additional_earwig_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8509a8d04d5c921e1feda0af5778fe8ee5cd855f2b44f10d4e663dcf24e7213 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-101814

Malicious code in additionalsawfishz3n npm...

EUVD-2025-93361

Malicious code in additionalreptilez3n npm...

MAL-2025-111644 Malicious code in additional_guanaco_coffee-100 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d2b7566d2ca9ab3fbb3ecdb94510d243e97c9b0cd383588b67b3d0afa5aebf5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in additional_sloth-appteadev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3abbed89ecd3b20eb1115acc58bce0ec3353226f1d0d9f3f8acae7ebc93715f2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-75073

Malicious code in additionaldragonfly-excellentdev npm...

EUVD-2025-77813

Malicious code in additionalcoralz3n npm...

EUVD-2025-79869

Malicious code in additionalostrich0xrequest npm...

EUVD-2025-65427

Malicious code in additionalkiterequirement npm...

EUVD-2025-65429

Malicious code in additionalbonoboz3n npm...

EUVD-2025-65425

Malicious code in additionalsailfishz3n npm...

Malicious code in additional_kite_requirement (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a996870fa06ef1680ebc6e2b1869c798e348e01c0932e1ed879e3e7ced35408 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-87327

Malicious code in additionalaardvarkz3n npm...

Malicious code in additional-orange-sole (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a20412ac8b48c05ef485d7d12ee5e870cedced47b4e14a6f36aa0b48210eb3a1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in additional-copper-lynx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 812ceae987943be1a55957836d51175c3abae7bc3c6dc793fda417401f143508 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in additional-coral-tapir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e96f97a6e6e8f8887ac9e3a4d81e6862cfb105d5471195e540fdc5904a18bfe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...