MAL-2025-118487 Malicious code in zul-bakwan50-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74073717ff71c2c7e2383e9a5b4c92a3f0b4097b2373615cbb7f8ebb36711958 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-115101 Malicious code in joni-kepok33-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd34310bada418c378baadfb127a8f7347d75ea9ae0f65a30673239dcbbd7e41 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-114959 Malicious code in jaja-gorengan76-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a0b828dc67aa34ba1138da912d268b7d716d0953ddca62afa133448e828796b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-114367 Malicious code in governing_walrus_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94bbe717edcfec2b8833573588e668aef45cf9038d52e8a0511f005d4f0fbe75 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-117107 Malicious code in siska-empal21-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2578c4439316c6e126f042ee41da8f3084f812a78431791409253be5e5dde0c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)

Summary Multiple vulnerabilities were remediated in IBM Observability with Instana OnPrem build 1.0.307 Vulnerability Details CVEID:CVE-2025-57810 DESCRIPTION: jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.2, user control of the first argument of the addImage method results in C...

CVE-2025-11960

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Aryom Software High Technology Systems Inc. KVKNET allows Reflected XSS. This issue affects KVKNET: before 2.1.8...

CVE-2025-12787 Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generation

The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to unauthorized booking cancellation in all versions up to, and including, 1.1.27. This is due to the plugin's "tfhbmeetingformsubmitcallback" function using insufficiently random values to generate...

CVE-2025-12787 Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generation

The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to unauthorized booking cancellation in all versions up to, and including, 1.1.27. This is due to the plugin's "tfhbmeetingformsubmitcallback" function using insufficiently random values to generate...

CVE-2025-12787

CVE-2025-12787 affects Hydra Booking — Appointment Scheduling & Booking Calendar (WordPress) up to version 1.1.27, allowing unauthenticated cancellation of arbitrary bookings. The root cause is insufficiently random cancellation tokens combined with a globally shared nonce in the tfhb_meeting_for...

CVE-2025-41731

A vulnerability was identified in the password generation algorithm when accessing the debug-interface. An unauthenticated local attacker with knowledge of the password generation timeframe might be able to brute force the password in a timely manner and thus gain root access to the device if the...

Malicious code in bad_lobster_green-14 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21efefd45db9af7eddd4266ad0cd91490c86d0c3e7d4ac900419a890d8e0b00d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-112178 Malicious code in patient_spoonbill_gray-49 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2045a997a570254736e4d4300a406ea048194ccdc2471b422d415778280a8bf4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-111932 Malicious code in future_deer_aquamarine-97 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c5aca048db283ba6f0477ee78ef377f0b176bc855f913423e78cb5b859bda6c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in advisory_asp_replicate_automation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 788652fa4bffe46698975efc2c68af9ce9d40cf64d60784cbc760d95ebda2051 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in glamorous_bedbug-teagooddev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae1852e0fc7e01beef5981371bbe49a9b3faeb728673efa84319035d856a4314 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ugly_finch-appteadev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d723b856ef8f8685ddf7caea0ced4c11e863a16cc7df2210b56cd6902ab2f407 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-101300 Malicious code in delicate_kingfisher-notthedev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99d7091171db92f31240fef8344a99438b7512cabc736607f819d1b289866e08 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-108642 Malicious code in short_walrus-appteadev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95fd7db9c0ed81468d63983a59d48080c4c3ad9643baa2fc775cd3fb22ad8a93 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in functional_prawn-appteadev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 461fb24c2fb17ee5ea26e4e8a2329a964e32ce9c30d2fbbc5feaf9ba40ac8b54 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...