13226 matches found
CVE-2025-59840 Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global variable
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to version 6.2.0, applications meeting 2 conditions are at risk of arbitrary JavaScript code execution, even if "safe mode" expressionInterpreter is used. They...
CVE-2025-40161
In the Linux kernel, the following vulnerability has been resolved: mailbox: zynqmp-ipi: Fix SGI cleanup on unbind The driver incorrectly determines SGI vs SPI interrupts by checking IRQ number 16, which fails with dynamic IRQ allocation. During unbind, this causes improper SGI cleanup leading to...
1 million victims, 17,500 fake sites: Google takes on toll-fee scammers
A Phishing-as-a-Service PhaaS platform based in China, known as “Lighthouse,” is the subject of a new Google lawsuit. Lighthouse enables smishing SMS phishing campaigns, and if you’re in the US there is a good chance you've seen their texts about a small amount you supposedly owe in toll fees...
EUVD-2025-178695
Malicious code in global-schema-unuk-gemini npm...
EUVD-2025-178696
Malicious code in global-sadr-polaris-scorpius npm...
MAL-2025-189829 Malicious code in taurus-interferometry-global-ultra (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 423d2fb9cd944e08525cd67c996f1e7bc14d018867030474945cf79ccd4d9b79 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-187311 Malicious code in heliophysics-aurora-lint-staged-global (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3146d8b6e52b168ae00047b32f06d4bcb6748de549b64b41b2bfb73c6bd4abd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-178571
Malicious code in heliophysics-aurora-lint-staged-global npm...
EUVD-2025-178702
Malicious code in global-eridanus-yakutsk-prompts npm...
EUVD-2025-178707
Malicious code in global-apollo-dysonswarm-nebula npm...
EUVD-2025-177837
Malicious code in mineralogy-less-loader-dagda-global npm...
EUVD-2025-179999
Malicious code in bootes-global-luna-galaxy npm...
EUVD-2025-178701
Malicious code in global-gridsome-oauth-supervisor npm...
EUVD-2025-178703
Malicious code in global-docusaurus-postcss-ora npm...
MAL-2025-188730 Malicious code in planckscale-lynx-global-transform (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d3a6f504f1e5767dfec6a0695658c17cb181816e481c901e238aa4397ec5924 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-178909
Malicious code in filament-thuban-global-volcanology npm...
EUVD-2025-177211
Malicious code in phoebe-global-google-yakutsk npm...
Malicious code in perseus-global-meissa-terser-webpack-plugin (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0d1ec9c95ff2971057d9bc9322cd0e3f96d82bf169f302e6f77174d3922dff9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...