mariadb: MariaDB Server Crash via Item_direct_view_ref

A flaw was found in MariaDB Server. This vulnerability may allow an attacker to crash the database via Itemdirectviewref::derivedfieldtransformerforwhere...

mariadb: MariaDB Server Crash via Item_direct_view_ref

A flaw was found in MariaDB Server. This vulnerability may allow an attacker to crash the database via Itemdirectviewref::derivedfieldtransformerforwhere...

mariadb: MariaDB Server Crash via Item_direct_view_ref

A flaw was found in MariaDB Server. This vulnerability may allow an attacker to crash the database via Itemdirectviewref::derivedfieldtransformerforwhere...

EUVD-2025-206092

RAGFlow is an open-source RAG Retrieval-Augmented Generation engine. In versions prior to 0.22.0, the use of an insecure key generation algorithm in the API key and beta assistant/agent share auth token generation process allows these tokens to be mutually derivable. Specifically, both tokens are...

CVE-2025-53960

When issuing JSON Web Tokens JWT, Apache StreamPark directly uses the user's password as the HMAC signing key e.g., with the HS256 algorithm. An attacker can exploit this vulnerability to perform offline brute-force attacks on the user's password using a captured JWT, or to arbitrarily forge...

EUVD-2025-203092

Apache StreamPark: Use the user’s password as the secret key Vulnerability...

CVE-2025-53960

When issuing JSON Web Tokens JWT, Apache StreamPark directly uses the user's password as the HMAC signing key e.g., with the HS256 algorithm. An attacker can exploit this vulnerability to perform offline brute-force attacks on the user's password using a captured JWT, or to arbitrarily forge...

PT-2025-47922

Name of the Vulnerable Software and Affected Versions Fluent Bit versions prior to 4.1.1 Description The out file plugin in Fluent Bit does not properly sanitize tag values when creating output file names. If the File option is not specified, the plugin utilizes tag input, which is considered...

TencentOS Server 4: mariadb (TSSA-2025:0632)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0632 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

Malicious code in sun-good-optimize-big-sandbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 404e006eb03ec8cfaca6aa369af6610f8b08252f71d38cab7166cae41a91fad2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rigel-miranda-cache-cz-conventional-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f24d18ebd38c79524545d193434c68697eb21e47a21abb2e7f108ae969d00566 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-188190 Malicious code in nconf-gemini-webdriver-mocha-forever (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7e8722c814d02682ad652c04b378d4dc3c4eb3d425cc1f427ccd04011bbea9e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-185713 Malicious code in axios-envconfig-antimatter-xenos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9e13721c20695ceedd4b482837dbb84cd436a7acde3112801215ee490c3c1ff This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in item-at-labka (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87745aaac0357ce2091df305d10cd849015782459c4c10a20face3f7bf597d12 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-184580 Malicious code in odasv-kinu-bobacuon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b95de16ce4aa95ba461c2d8ffbcad7e307b443730c4a424c44bfb182a696bf54 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-183305 Malicious code in kiudt-acvog-uu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1009aaac588a708677af48ab3c6533a3db218f7271aeda455f768e367d866cd6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-178248 Malicious code in rindaman-poke81 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fcd6ce49bf87c91c53dad962d2c987f9120789fa1f3c02be63fba333ed3a1fb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in taufiqcroissant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33fd91ef4d7b131ff084eab6f31dd2d79933f8331229ea8a2699f7fe3e815b32 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-171660 Malicious code in nishasen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc8d508ebc05fbdf25f7d23029b384e933626ddf3900821d127f454769b7a185 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teagood-manaki42 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c712dd1da353e69dc6ec3f5e2a73cff4f5fd119a933fde692e86e1acf84364a3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...