Malicious code in yanti-moci69-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d17ab4260f24ff776cfcb563857068c5b01a1532e9e7d98ccc493ad00c56084 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-117762 Malicious code in valuable_anteater_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc6af08a8e039811b2b26a6973c36693758ac0587dd5546a876539026072206c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in irma-ruwet11-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5bfcc87c4130aba4833eff0bf9277e3d8f19889582dd131bbebba8062b95b39a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eka-rujaksoto87-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de6162cabfac2a624c94d3701075b8338c0286805a4906661bc3c51fd6e0413f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in maman-semur33-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 563847061761689ada08941c816a873997dd187324710b05ad7e1c2b457ea66c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in worthwhile_prawn_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8e34193bce103def513324a8b2d9b1d6ab5d75e13422c4213ced61a12b86ff0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-113905 Malicious code in fantastic_magpie_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e7eec6b7c0719412c0a7635f4eca6b3f38a530d4b0dd177248da0447d1741e9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-117107 Malicious code in siska-empal21-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2578c4439316c6e126f042ee41da8f3084f812a78431791409253be5e5dde0c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-115101 Malicious code in joni-kepok33-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd34310bada418c378baadfb127a8f7347d75ea9ae0f65a30673239dcbbd7e41 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-116792 Malicious code in rifqi-rojak2-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5553e774deab000565c71eafe3702dbfebc586994aee160313be6d8c9153e76 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-114959 Malicious code in jaja-gorengan76-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a0b828dc67aa34ba1138da912d268b7d716d0953ddca62afa133448e828796b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-114367 Malicious code in governing_walrus_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94bbe717edcfec2b8833573588e668aef45cf9038d52e8a0511f005d4f0fbe75 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-118487 Malicious code in zul-bakwan50-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74073717ff71c2c7e2383e9a5b4c92a3f0b4097b2373615cbb7f8ebb36711958 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-116937 Malicious code in sad_silkworm_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f09339c265038351cb4b7ee185fe567f73b902ae28a2a3785b10358874d79c8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)

Summary Multiple vulnerabilities were remediated in IBM Observability with Instana OnPrem build 1.0.307 Vulnerability Details CVEID:CVE-2025-57810 DESCRIPTION: jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.2, user control of the first argument of the addImage method results in C...

CVE-2025-11960

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Aryom Software High Technology Systems Inc. KVKNET allows Reflected XSS. This issue affects KVKNET: before 2.1.8...

CVE-2025-12787 Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generation

The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to unauthorized booking cancellation in all versions up to, and including, 1.1.27. This is due to the plugin's "tfhbmeetingformsubmitcallback" function using insufficiently random values to generate...

CVE-2025-12787

CVE-2025-12787 affects Hydra Booking — Appointment Scheduling & Booking Calendar (WordPress) up to version 1.1.27, allowing unauthenticated cancellation of arbitrary bookings. The root cause is insufficiently random cancellation tokens combined with a globally shared nonce in the tfhb_meeting_for...

CVE-2025-12787 Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generation

The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to unauthorized booking cancellation in all versions up to, and including, 1.1.27. This is due to the plugin's "tfhbmeetingformsubmitcallback" function using insufficiently random values to generate...

CVE-2025-41731

A vulnerability was identified in the password generation algorithm when accessing the debug-interface. An unauthenticated local attacker with knowledge of the password generation timeframe might be able to brute force the password in a timely manner and thus gain root access to the device if the...