MAL-2025-103640 Malicious code in helpful_fowl_0xrequest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 044e9e57b00aff3484b6ad9f108bdcc26715b6b67c1e353a2d30874868806ee7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hon_canid_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e59ce1f76e369f6f80f205637fcf98dfb762514b8ef3d2e4f9c9feedff597bf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-89923 Malicious code in reliable_sturgeon_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac3a1dfd524b609e3664a9cab6e54b4a354c2bb41422207ddb704f31252d682d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-67178 Malicious code in chosen-lime-snipe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1328f512e5f3b3537c9ce44f62d52e3ddd47dac95df8b72e4f8dccb3bdcdfc83 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in monthly-salmon-rhinoceros (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cebbef619ca17a4e595a1f2a7b7ac82288ef753032796d06a4e1936af66be667 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

WebKit DoS

The vulnerability of the Web page rendering module in WebKit operating systems for iOS and iPadOS relates to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

WebKit DoS

The vulnerability of the web page rendering module in WebKit operating systems for iOS and iPadOS relates to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

Linux Kernel BPF Parse Parameter DoS

The vulnerability of the bpfparseparam function in the kernel/bpf/inode.c module of the Linux operating system is related to the lack of memory release after the effective lifespan has ended. Exploiting this vulnerability could allow an attacker to cause a service failure...

Linux kernel Namespace Function Copy Mnt Ns DoS

The vulnerability of the copymntns function in the fs/namespace.c module of the Linux file system support module is related to improper cleanup during exception handling. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2025-64187

OctoPrint provides a web interface for controlling consumer 3D printers. Versions 1.11.3 and below are affected by a vulnerability that allows injection of arbitrary HTML and JavaScript into Action Command notifications and prompts popups generated by the printer. An attacker who successfully...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization. An attacker can disrupt control over a running virtual machine instance by creating a pod with identical labels to the legitimate virt-launcher pod, misleading the controller into associating the fake pod with t...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization. An attacker can disrupt control over a running virtual machine instance by creating a pod with identical labels to the legitimate virt-launcher pod, misleading the controller into associating the fake pod with t...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization. An attacker can disrupt control over a running virtual machine instance by creating a pod with identical labels to the legitimate virt-launcher pod, misleading the controller into associating the fake pod with t...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization. An attacker can disrupt control over a running virtual machine instance by creating a pod with identical labels to the legitimate virt-launcher pod, misleading the controller into associating the fake pod with t...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization. An attacker can disrupt control over a running virtual machine instance by creating a pod with identical labels to the legitimate virt-launcher pod, misleading the controller into associating the fake pod with t...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization. An attacker can disrupt control over a running virtual machine instance by creating a pod with identical labels to the legitimate virt-launcher pod, misleading the controller into associating the fake pod with t...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization. An attacker can disrupt control over a running virtual machine instance by creating a pod with identical labels to the legitimate virt-launcher pod, misleading the controller into associating the fake pod with t...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization. An attacker can disrupt control over a running virtual machine instance by creating a pod with identical labels to the legitimate virt-launcher pod, misleading the controller into associating the fake pod with t...

CVE-2025-54863

Radiometrics VizAir is vulnerable to exposure of the system's REST API key through a publicly accessible configuration file. This allows attackers to remotely alter weather data and configurations, automate attacks against multiple instances, and extract sensitive meteorological data, which could...

CVE-2025-64187

OctoPrint provides a web interface for controlling consumer 3D printers. Versions 1.11.3 and below are affected by a vulnerability that allows injection of arbitrary HTML and JavaScript into Action Command notifications and prompts popups generated by the printer. An attacker who successfully...