Malicious code in ogi-keripik1-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e63196ab1a721693910ca4acfeee1f7104676de3a7b493949da8d3742a11ec0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Moderate: Red Hat Security Advisory: Red Hat Developer Hub 1.8.0 release.

Red Hat Developer Hub 1.8.0 has been released. Red Hat Developer Hub RHDH is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters AKS, EKS, GKE. The core features of RHDH include a single...

CVE-2025-12155 Command Injection in Looker

A Command Injection vulnerability, resulting from improper file path sanitization Directory Traversal in Looker allows an attacker with Developer permission to execute arbitrary shell commands when a user is deleted on the host system. Looker-hosted and Self-hosted were found to be vulnerable. Th...

MAL-2025-54090 Malicious code in oktafian-telur63-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35122975f1549bde23d98820c8c09450a58c7dd7e216319fa07690d6505aa31b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-54117 Malicious code in patria-kacang82-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc50fc7cbbd187e227beae59cdb3994e8f37e441f82c013f224a27ed9e0afdb8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in qori-bakwan94-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfdf9cfcd74cd3fe6421457f3a0cbd3733636e82a0aef97764f627317462efdc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gita-nasisayur38-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a492550863a563bbd801188f0a1ffa31969ecccad3dbe366d5092986d2591d6f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-53137 Malicious code in kresna-rangginang100-devapp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec8d5eb16c57658f39b8942a122f5bc8511ef9f03abfc8a9898fe25b587289ae This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-51925 Malicious code in galih-getas87-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90927df9d05d864de2327de4433a29ad4e0a0c172acaad3e782cd4fc1fd8e763 The package galih-getas87-ruro was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...

Apple macOS Sequoia Privilege Restriction Insufficiency Vulnerability

Apple macOS Sequoia is an operating system announced by Apple on June 10, 2024 at the WWDC24 developer conference. Apple macOS Sequoia suffers from an insufficient privilege restriction vulnerability that can be exploited by an attacker to cause the disclosure of sensitive user data...

CVE-2025-12155: Improper Neutralization of Special Elements used in a Command

A Command Injection vulnerability, resulting from improper file path sanitization Directory Traversal in Looker allows an attacker with Developer permission to execute arbitrary shell commands when a user is deleted on the host system. Looker-hosted and Self-hosted were found to be vulnerable. Th...

Exploit for CVE-2025-12907

Chrome DevTools RCE Exploit CVE-2025-12907 Overview This...

CVE-2025-12909

Insufficient policy enforcement in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to leak cross-origin data via Devtools. Chromium security severity: Low...

EUVD-2025-38338

Insufficient validation of untrusted input in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to execute arbitrary code via user action in Devtools. Chromium security severity: Low...

PT-2025-45387

Name of the Vulnerable Software and Affected Versions 3scale Developer Portal affected versions not specified Description A flaw exists in the 3scale developer portal that could allow account creation or updates through hidden or read-only fields. This allows an attacker to potentially access or...

CVE-2024-12125: Improper Preservation of Permissions

A flaw was found in the 3scale Developer Portal. When creating or updating an account in the Developer Portal UI it is possible to modify fields explicitly configured as read-only or hidden, allowing an attacker to modify restricted information...

CVE-2025-63418: Improper Neutralization of Input During Web Page Generation

A DOM-based Cross-Site Scripting XSS vulnerability in the SelfBest platform 2023.3 allows attackers to execute arbitrary JavaScript in the context of a logged-in user's session by injecting payloads via the browser's developer console. The vulnerability arises from the application's client-side...

CVE-2025-63418

The SelfBest platform version 2023.3 is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. The root cause is client-side code susceptible to direct DOM manipulation due to a lack of adequate sanitization or a Content Security Policy (CSP) . Attackers can execute arbitrary JavaScrip...

CVE-2025-62369 Xibo CMS: Remote Code Execution through module templates

Xibo is an open source digital signage platform with a web content management system CMS. Versions 4.3.0 and below contain a Remote Code Execution vulnerability in the CMS Developer menu's Module Templating functionality, allowing authenticated users with "System - Add/Edit custom modules and...

Xibo CMS security vulnerabilities

Xibo CMS is an open source content management system from Xibo Digital Signage. A security vulnerability exists in Xibo CMS 4.3.0 and prior versions, which stems from a mishandled Twig filter in the Module Templates feature in the CMS Developer menu, which could lead to remote code execution...