Malicious code in clean-apricot-bee (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9dba1ca0b854348f73cde18ebc5d9ac69e278932bde2003c431311c8904f0d7d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-55436

Malicious code in clean-apricot-sole npm...

EUVD-2025-55435

Malicious code in clean-beige-rabbit npm...

EUVD-2025-55432

Malicious code in clean-plum-canid npm...

EUVD-2025-55437

Malicious code in clean-apricot-bee npm...

MAL-2025-67214 Malicious code in clean-beige-rabbit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7bb34f09cc917a19339fb2fb5bc5c75769b4b286ae12e2f4e65abe4fe0d82c0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-67215 Malicious code in clean-coral-egret (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61e3cf14abf3c1519fbd6df29483251c0dd8f3582715751999b0b6be416de04d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-60279

Malicious code in cleanbeetlez3n npm...

EUVD-2025-48306

Malicious code in cleangibbonz3n npm...

OS Command Injection

github.com/chaos-mesh/chaos-mesh is vulnerable to OS command injection. The vulnerability is due to improper input validation in the cleanIptables mutation, which allows an unauthenticated in-cluster attacker to execute arbitrary commands and achieve remote code execution across the cluster...

CVE-2025-10008

The Translate WordPress and go Multilingual – Weglot plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'cleanoptions' function in all versions up to, and including, 5.1. This makes it possible for unauthenticated attackers to delete limited...

CVE-2025-10008 Translate WordPress and go Multilingual – Weglot <= 5.1 - Missing Authorization to Unauthenticated Limited Transient Deletion

The Translate WordPress and go Multilingual – Weglot plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'cleanoptions' function in all versions up to, and including, 5.1. This makes it possible for unauthenticated attackers to delete limited...

CVE-2025-10008

CVE-2025-10008 affects Translate WordPress and go Multilingual – Weglot plugin for WordPress. Root cause: missing capability check in clean_options, allowing unauthenticated deletion of limited transients (cached plugin options) in all versions up to and including 5.1. Impact: unauthorized data l...

EUVD-2025-36900

The Translate WordPress and go Multilingual – Weglot plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'cleanoptions' function in all versions up to, and including, 5.1. This makes it possible for unauthenticated attackers to delete limited...

PT-2025-44371

Name of the Vulnerable Software and Affected Versions Translate WordPress and go Multilingual – Weglot plugin for WordPress versions up to and including 5.1 Description The software is susceptible to unauthorized data loss. This is due to a missing capability check within the clean options...

Malicious code in @aio-commerce-sdk/config-typescript (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 85b2c7fad2af3e611f7fe4d8399529e1b897e4ca8838e1a5db0a2c61acb4d998 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-62792 Wazuh vulnerable to Heap-based Buffer Over-read in w_expression_match

Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.12.0, a buffer over-read occurs in wexpressionmatch when strlen is called on strtest, because the corresponding buffer is not being properly NULL terminated during its allocation in OSCleanMSG...

EUVD-2022-54582

In the Linux kernel, the following vulnerability has been resolved: dmaengine: qcom: bamdma: fix runtime PM underflow Commit dbad41e7bb5f "dmaengine: qcom: bamdma: check if the runtime pm enabled" caused unbalanced pmruntimeget/put calls when the bam is controlled remotely. This commit reverts it...

SUSE SLES15 Security Update : kernel (SUSE-SU-2025:3725-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:3725-1 advisory. The SUSE Linux Enterprise 15 SP7 RT kernel was updated to receive various security bugfixes. The following security bugs were fixed: -...

WordPress Constructor plugin permission issue vulnerability

WordPress Constructor plugin is a framework for simplifying plugin development, mainly used to help developers quickly build and manage the plugin's components such as options pages, forms and custom fields. WordPress Constructor plugin suffers from a privilege issue vulnerability that stems from...