MAL-2025-81543 Malicious code in surya-rangi42-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b883cc588e04920f64b18145d8ecbfc3205be2bd672789aa0b3d8f7b69f735c5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in biological_giraffe_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c5bcae5465976c24198ec96e10a138805724da6951ba3e9744235ab38a43ceb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ida-lepet22-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b80d52b52e11d5091f352ebab9b07587cd530c65947910ca59f3d6f656fbbae2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-76857 Malicious code in andi-tempe15-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2004d468fce32be558925096d8b6cfeafcc0a90a021b7d569983ef389911258b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-12526 Private Google Calendars <= 20250811 - Missing Authorization to Authenticated (Subscriber+) Settings Reset

The Private Google Calendars plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pgcremove' action in all versions up to, and including, 20250811. This makes it possible for authenticated attackers, with Subscriber-level access and...

EUVD-2025-60994

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI lookup operations, enabling access to an unintended JNDI provider.�This could further lead to disclosure or modification of information about the server. There i...

Malicious code in fauzi-mie73-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3034cf23f339f34d976064e5daf8a05350b66fe1456a5fa8419f89f41f64c04a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in umi-sate44-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b98216a8116e14baa1ad395cf668ced01e518d7863bed003809de9176d3c3f36 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gita-rawon72-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5bd550a90ff7685b8419d25973a30a96db888ffb6390c226ad81ccd03314f13 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in oktafian-lontong3-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9eebd19cd655d272703db8d554f1cac34b65160a3e055c2abc1a3cb081b3582f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lisa-martabak62-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d34d4ed0aef7959c15d53fb039cfaede7cb7710177a3665025f096703436b869 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in evil-coffee-dragonfly (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ae3664e06efedba15e365b53fc802368b75cd727a341aef99f6cea2819bedb3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in weekly-copper-grouse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4331caae1eb3bea0eb7b19d037e2ba2e0218028f98298cad73e5db77e6c941d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-68986 Malicious code in isolated-bronze-jackal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6235956f79263662ff129bf606e13aa3be29e48587b62990b39121fd5ecceba5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-66955 Malicious code in bewildered-black-magpie (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b88694bd596902a819757c99cd9716dc39c7efe1bdb23496e6a76ab1425a23e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in amused-amber-partridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe92f325cb2f8bba585932c37dc597908665232e0bb19aa3a0e58f25bd93b49d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fadhil-mangut38-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96fe5ad1e7fd741699e8a86dc25d4028da1eba3b81d707b7bad9afa9599259c4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kiki-sego51-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dba2e337197c1ad515d762d394ab3b747664b5c33aabec70bf542cb3e78ec41f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-66436 Malicious code in zain-tahu3-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90be907761b961f32e2c680ed27fe926f4ec3c464cd87f0dbdf5393ccb0df05c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

PT-2025-46325

Name of the Vulnerable Software and Affected Versions The Classified Listing – AI-Powered Classified ads & Business Directory Plugin versions up to and including 5.2.0 Description The Classified Listing – AI-Powered Classified ads & Business Directory Plugin for WordPress is susceptible to...