Malicious code in grubby-silver-chinchilla (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 24d0574725fe4a8eb858a2497850d49ac98154fbf42fb40523e9454ed99fe3a2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gleaming-amaranth-deer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d5270c7996565141cca335512a3cf42f4182c9b0f21430c769330f15a65df15 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-65499 Malicious code in surya-tempe45-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e9fb46902c2971a081379d0b3fcc638ec3aef5c5691f71635db1063971ebf83 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in noble_caribou_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bd800c6baf4a4d0607b546f30a7b2ad6f8b6189f5354d14a87f3d9e0a488bc5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-57695 Malicious code in mulyono-toge81-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cf607b05f373bd0ebf725c3950311dfdf0acd1a02170ce1a629d04c194730c7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in iwan-brengkes8-sumpek (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72562e05b1a0ab7da3612d611ce92b5c9b5ccfbcb6b6af655cc61e437042055a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ida-getuk91-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector adaeac6a945b618ec4d76c886e37e03a022112d2168667ce04c08f1f3f71bf61 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-51266 Malicious code in cici-getas82-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffd1a64c334d0289bac534bdbeccca6366621d339a1ee7c5422625d566056135 The package cici-getas82-riris was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...

MAL-2025-51494 Malicious code in dewanto-otak-otak83-wekto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbc1d326a2f350803d865077a6d72a6832e127d2b4a4a48ff98a7c91f6a2a3a9 The package dewanto-otak-otak83-wekto was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

PT-2025-45610

Name of the Vulnerable Software and Affected Versions SOPlanning version 1.53.02 Description A stored Cross Site Scripting XSS issue exists in SOPlanning version 1.53.02. This is due to insufficient validation of user-supplied data. An attacker can exploit this by sending a POST request utilizing...

JetBrains ReSharper 安全漏洞

JetBrains dotTrace is a professional .NET performance analysis tool from JetBrains Czech Republic that is used to detect and analyze performance bottlenecks in .NET and .NET Core applications. This CVE number has been withdrawn...

CLSA-2025-1762544268 rsync: Fix of CVE-2016-9840

CVE-2016-9840: fix improper pointer arithmetic in inftrees.c...

CVE-2025-60200 WordPress LearnPress Export Import plugin <= 4.1.2 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThimPress LearnPress Export Import learnpress-import-export allows PHP Local File Inclusion.This issue affects LearnPress Export Import: from n/a through = 4.1.2...

CVE-2025-50735

Directory traversal vulnerability in NextChat thru 2.16.0 due to the WebDAV proxy failing to canonicalize or reject dot path segments in its catch-all route, allowing attackers to gain sensitive information via authenticated or anonymous WebDAV endpoints...

WordPress plugin DominoKit 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...

CVE-2025-50735

Directory traversal vulnerability in NextChat thru 2.16.0 due to the WebDAV proxy failing to canonicalize or reject dot path segments in its catch-all route, allowing attackers to gain sensitive information via authenticated or anonymous WebDAV endpoints...

CVE-2025-50735

Directory traversal vulnerability in NextChat thru 2.16.0 due to the WebDAV proxy failing to canonicalize or reject dot path segments in its catch-all route, allowing attackers to gain sensitive information via authenticated or anonymous WebDAV endpoints...

CVE-2025-11499

creationtimestamp| type| source ---|---|--- 2025-11-02 03:00:06+00:00| published-proof-of-concept| Telegram/OZ23IKbQ47oGvBTE7eizQgpIhDfJ5XALPOlUhm63kbbFXAA 2025-12-23 12:48:55+00:00| seen| https://poliverso.org/objects/0477a01e-b719cfbf-8634aa78376c4ba2...

EUVD-2025-37200

IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 21 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view, overwrite, or append to arbitrary files on the system...

EUVD-2025-37199

IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 21 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system...