Malicious code in init-bootes-radiant-aether (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 050a045bc10e41c3926121ea922e01fa47baa0f522d718879a886b21ba3357bd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-990800)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990800 advisory. In the Linux kernel, the following vulnerability has been resolved: drbd: use after free in drbdcreatedevice The drbddestroyconnection frees the connection so use th...

Malicious code in dewanto-ronde24-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1a6ebff09d28763b757cf21d483de1fc81adc62632f1529cc9d9bcbb33213d7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-120243 Malicious code in gilang-kue69-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 213a79ccb7b5c76733d07d641dbb6d2887cdafee55a3dc8012b40dc5ea14f126 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-107787 Malicious code in recent_bird_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53a9337f9db6a80d12d843dc8dbb3d4155e06e8c6221f0e089f815a90c3deb64 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-85518 Malicious code in fauzi-kupat89-sumpek (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3cff856a1bbc1d7e7eddbb70f7376d6ec01dd575317d9d755d3a8394d675fd78 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in putri-nasi51-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6a4a237e86e60effb3593bdcb0349065e9938e7e5789c6e16fc396d4d6fb436 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-62756 Malicious code in erick-empal86-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 970dff4e76c589dbd5bf39d924a0a4d927ad56c53c4f6d77bc8d3a9aec5fef9c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-12126: Authorization Bypass Through User-Controlled Key

The The Total Book Project plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0 via several functions due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access a...

CVE-2025-11855: Undefined Security Weakness

The age-restriction WordPress plugin through 3.0.2 does not have authorisation in the agerestrictionRemoteSupportRequest function, allowing any authenticated users, such as subscriber to create an admin user with a hardcoded username and arbitrary password...

create-bamboo (>=1.0.1, <=1.0.2) potentially affected by unknown CVE via bamboo-init (1.0.7)

bamboo-init NPM version 1.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on bamboo-init and may be impacted: - create-bamboo =1.0.1, =1.0.2 Source cves: unknown CVE Source advisory: OSV:MAL-2025-50934...

Medium: fontforge

Issue Overview: FontForge v20230101 was discovered to contain a memory leak via the component DlgCreate8. CVE-2025-50949 Affected Packages: fontforge Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras...

CVE-2025-12621

The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on the 'createrefund' function in all versions up to, and including, 1.0.42. This makes it possible for authenticated attackers, wit...

CVE-2025-12621 Flexible Refund and Return Order for WooCommerce <= 1.0.42 - Incorrect Authorization to Authenticated (Contributor+) Refund Status Update

The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on the 'createrefund' function in all versions up to, and including, 1.0.42. This makes it possible for authenticated attackers, wit...

EUVD-2025-38325

A stored cross-site scripting XSS vulnerability in the CrushFTP 11.3.750 Admin Panel Reports / 'Who Created Folder' allows authenticated attackers with permissions to create folders to inject malicious HTML/JavaScript...

CVE-2025-64490 SuiteCRM's Inconsistent RBAC Enforcement Enables Access Control Bypass

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Versions 7.14.7 and prior, 8.0.0-beta.1 through 8.9.0 allow a low-privileged user with a restrictive role to view and create work items through the Resource Calendar and project screens, even...

WordPress plugin Flexible Refund and Return Order for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

Incorrect Permission Assignment for Critical Resource

Overview Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource via the hostDisk process in the virt-handler component when mounting a host file or directory using the DiskOrCreate option. An attacker can gain unauthorized access to and modify...

CVE-2025-63638

Sourcecodester AI-Powered To-Do List App v1.0 is vulnerable to Cross-Site Scripting XSS in the "Task Title" and "Description Optional" fields when creating a Task, allowing an attacker to inject arbitrary potentially malicious HTML/JavaScript code that executes in the victim's browser upon clicki...

The vulnerability of the `__trace_eprobe_create()` function in the kernel/trace/trace_eprobe.c module, which supports kernel tracing in Linux operating systems, allows a hacker to trigger a service failure.

The vulnerability of the traceeprobecreate function in the kernel/trace/traceeprobe.c module, which supports tracing of the Linux operating system’s kernel, is related to the assignment of pointers. Exploiting this vulnerability could allow an attacker to cause a service failure...