PT-2026-52611

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.0.10 Description An authenticated user can change their account password through the account settings Security section without providing the current password or any additional verification. This occurs because the...

CVE-2025-11923

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to privilege escalation. This is due to the plugin not properly validating a user's identity prior to allowing them to modify their own role via the REST API. The permission check in the...

Malicious code in development-dependencies-cybernetics-cryptography (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 394b529057f391623b292a4b60d7a51f780d22380dc2cdc5a4c2595970c8ba9a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eigenstate-electron-lithosphere-dagda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4419ee7a3321834a9fe9daaccbc01f465940828b5b1ffbf986135d57c87ec87f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in luminescence-meteor-elara-oortcloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4723173953a883601c99304b5c4f785f659720aa6bab31360b538d209ba19485 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in got-paleoclimatology-nebula-commitizen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c594bf125d3e98c114785d243fe86ffa7d25834160d19bd9debc56f1fabc9f4f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in inflation-apollo-rocket-higgs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 395b1247c5e72e553ae03620ece5fc27af309bb24287205d0b5f511c0c7a50f2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in xanthus-child-process-radiant-biotechnology (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0772cba129a84f6a60d24186646d0488d9fea195f97e08ef3a181221632a17c1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in json-miranda-karma-auth0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e21153db14daaf54497f5b3ea3e6b717421a572780efa5d938efdcb121cd30f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in prettier-pegasus-version-sirius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07184acbaeb5b745eda222d46eac28e2940e487c1388e93807d25bcb67d72286 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dog-book-protected-scale-grid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50e2dfc946835cb804fbf4f49f9dca6adcc7592bdd9880a1b5fc2f3e866af4dd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wind-psi-zeta-debug-zeta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cccb1fbb789018c346a5f6f4730f72aeec7f3a6b735977e2c9cd571c4d32b0a1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in loop-webdriverio-vulcan-proxima (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3f9d3f3f64e3dcfb01546c14df5e1d0e289308f7238bf5fb36f487b9e92423e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in iota-zephyr-nova-octans (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 474c33dcd82c42f216800019ef265100456f84354df000be4506aad7555b1467 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in upgrade-hexo-gulp-cosmogenic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fec89a7eb1a0e703849d699b2b85e2ad103da3e48674eb73284410a4a4e69b8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in superflare-paleoclimatology-pavo-lacerta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39d337f363e6d9af72d6c6c58ab9d0b6cff009263226481ce03f76293b809c53 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in view-deploy-scale-promise-await (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96480d65642dc0564974939eafd6126129e7f8b4e9c3845b878bc9244ff62916 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tau-fork-hot-web-big (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b1535674fe21c755cbdb872d3615e3794dce7ac1ab4df9d0b4982a0903171a6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cluster-volcanology-eslint-plugin-singularity (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09a823292dfa1cb7048c8d436418ff0a75354f1851e8773851776ba8f6a0c2eb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in apollo-geochronology-stream-readable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1853cf9a3f20a918e290a6d47a2239df7fb6e98aac8909d1af2210c7b228b0b8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...