MAL-2025-152234 Malicious code in alfiansyah-poke26 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97234601ef72c708c6285f3770e09582f5d13fb825d306af2b500025eb77f884 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in inufgi-gota-jamanna (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb501d6c6595cb581dcca1080266d46acbd59eb18a9577b2f140283095c51b86 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147632 Malicious code in sagitta-yakutsk-celeste-procyon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90591d766829f3a790ea4d9c1652e0505ea1c2f38420ac201bf0912f328d2cf2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kurnia-sambalado6-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d9031c951d8103b043b7714a6161621025447402e6b339502d4df551e03557b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-127338 Malicious code in improved_locust_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d75aa144d761f400c3ad554edbe3ec053ab1d094342df7fdc4992c6edb34735d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-116373 Malicious code in patria-nasiuduk86-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1531dfd87ae205f936f80f9ccf5e6c8cdd377a634066608861a0e476b6084f1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in empty_dragon_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 428668c18b042d689b19f2df190b616b054f6ce9b50bb793489c536177416c21 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in immense_puma_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c24166386cc70c07522f8d4285e84711785b8261aa02cbaf3c0301a4ee0affa3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-96223 Malicious code in recent_gerbil_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 837a2c910c52d23103860a06cbf459899e50aa4ecbab98abacaf516987d2647c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-81066 Malicious code in rifqi-papeda70-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2789cb91705c0beb3dbb118c1c624ea6b926a89659b8b85b0704ceaff5ec6af1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nana-serimuka86-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8bbe280b658dfc0a419cec79533b07869d374e5726ccf6b489ce0ade8a817b02 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-50489 Malicious code in tania-kentang46-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11743e1c9cdc52c20469d74ba69b2acf818f73f8a5c42a8e84deb7baaf823bbc The package tania-kentang46-sluey was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

Malicious code in ade-miemee32-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b081070c48f803ac468784972e23f4d7e4670c086b53ead14a57ed699171e95 The package ade-miemee32-miaww was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...

CVE-2025-12038

The Folderly plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the /wp-json/folderly/v1/config/clear-all-data REST API endpoint in all versions up to, and including, 0.3. This makes it possible for authenticated attackers, with...

CVE-2025-10303

The Library Management System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the owt7librarymanagementajaxhandler function in all versions up to, and including, 3.1. This makes it possible for authenticated attackers, with...

EUVD-2024-33499

Malicious code in bioql PyPI...

EUVD-2022-24628

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2025-30703

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0...

Oracle REST Data Services 跨站请求伪造漏洞

Oracle REST Data Services is an Oracle middleware tool for exposing Oracle database functionality to applications via a RESTful API. A security vulnerability exists in Oracle REST Data Services version 24.2.0 that originates from an unauthenticated attacker who can attack via HTTP web access,...

WordPress File Provider plugin cross-site request forgery vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. The WordPress File Provider plugin suffers from a cross-site request forgery vulnerability that stems from a lack of CSRF checks. An attacker could use this vulnerability to all...