Malicious code in tomi-dodol41-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f634d69b1e368034062e330d1ef542084bb287e3e2268e447fa9283060c82855 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kurnia-mangga19-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51e24829ab2152039311d864a870d92a85dfcf921c69b4377b86f5175232e23f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-128895 Malicious code in net_narwhal_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b7a3166da8e657edf572f7303a231255aca292a8387327219c7ac5dd9c275d7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-10905 Collision in minifilter driver of Avast Free Antivirus results in disabling of real-time protection

Collision in MiniFilter driver in Avast Software Avast Free Antivirus before 25.9 on Windows allows a local attacker with administrative privileges to disable real-time protection and self-defense mechanisms...

MAL-2025-118441 Malicious code in zaki-lumpur83-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d43647a8bf3db74d5af606baded011124ec91df7a8da2dbe8ae0540cd2cd6b2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

openssh: OpenSSH SSHD Agent Forwarding and X11 Forwarding

A flaw was found in OpenSSH. In affected versions of sshd, the DisableForwarding directive does not fully adhere to the intended functionality as documented. Specifically, it fails to disable X11 and agent forwarding, which may allow unintended access under certain configurations...

kernel: netfs: Fix the (non-)cancellation of copy when cache is temporarily disabled

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix the non-cancellation of copy when cache is temporarily disabled When the caching for a cookie is temporarily disabled e.g. due to a DIO write on that file, future copying to the cache for that file is disabled until al...

MAL-2025-111559 Malicious code in zippy_termite_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 633cbeed79c083fdb0d4d61017b12645a10b8eff7bf8f2429ade673f2f27ba0a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-93800 Malicious code in convincing_capybara_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1504d4215c7b652b5579739d29eb72596410a492de2e896cd29fd976b23a797e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in okta-lodeh24-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50be676821a60f3bc9aeec130ff91dd18b07a7065c9995d9c4ced7fbe944cfee This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-92650 Malicious code in yanti-ubi50-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0968e4a926407dffe42b72d442c14cfaa5c61352aa8709ce3330d02fbeade485 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-90988 Malicious code in tania-tongseng14-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8789d37862ac5fedf7b0a71a393d77141238ed91e7426aaecea445c35da7b78c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tiara-sasag2-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd9732c1ab0a23d0b03a6e37f969861a9902c5763fd9f14867d4129384abe70f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wati-klanting13-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36e9f6e3b00ad08548753112a3e8a4532290cddb7e8f018fa02044ee2e0c0a27 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in positive-harlequin-mackerel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d28ab96560978ece7800a09adfa1abc42662f736a969b03afab3e03fc52beaba This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-63889 Malicious code in kurnia-lupis39-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a59afbe017c08cb3bbaaec990e4f6abaf919c57837cdad72643ad398a8ea6322 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-57592 Malicious code in maya-rawon56-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e5186b6c138c221831bca2d49580d7bcf50b5dc66cae4c38c7df372d50fd32a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-64490

SuiteCRM (versions 7.14.7 and earlier; 8.0.0-beta.1 through 8.9.0) has an access-control flaw where a low-privileged user with a restrictive role can view and create work items via Resource Calendar and project screens even when related modules (Projects, Project Tasks, Tasks, Leads, Accounts, Me...

PT-2025-45401

Name of the Vulnerable Software and Affected Versions LC Wizard plugin for WordPress versions 1.2.10 through 1.3.0 Description The LC Wizard plugin for WordPress has a flaw that allows lower-privileged users to escalate to administrator rights. This is due to a missing capability check in the...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990579)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990579 advisory. In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: rk3399dmc: Disable edev on remove Otherwise we hit an unablanced enable-count when...