EUVD-2025-115798

Malicious code in callback-puppeteer-janus-global npm...

EUVD-2025-113190

Malicious code in global-andromeda-publish-nashira npm...

PT-2025-46878

Name of the Vulnerable Software and Affected Versions Vega versions prior to 6.2.0 vega-expression versions prior to 6.1.0 vega-interpreter versions prior to 2.2.1 vega-expression versions prior to 5.2.1 vega-interpreter versions prior to 1.2.1 Description Vega is a visualization grammar used for...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990753)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990753 advisory. In the Linux kernel, the following vulnerability has been resolved: gfs2: Check sbbsizeshift after reading superblock Fuzzers like to scribble over sbbsizeshift but ...

EUVD-2025-98464

Malicious code in globalleoponz3n npm...

EUVD-2025-98466

Malicious code in globalbeaverz3n npm...

EUVD-2025-98465

Malicious code in globalearthwormz3n npm...

Malicious code in global_weasel_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 261e149f3b6b86724ba37ece0083341a4fb853b865f11a1c42e87e20e8be5416 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-64689

In JetBrains YouTrack before 2025.3.104432 misconfiguration in the Junie could lead to exposure of the global Junie token...

CVE-2025-12787 Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generation

The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to unauthorized booking cancellation in all versions up to, and including, 1.1.27. This is due to the plugin's "tfhbmeetingformsubmitcallback" function using insufficiently random values to generate...

EUVD-2025-63855

Malicious code in globalbonoboz3n npm...

EUVD-2025-63854

Malicious code in globalmandrillz3n npm...

Malicious code in global_mandrill_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6d2173b8e8569db3a1d6613186ef9ac1a939cef19c0230e61abbd02830be3a3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-11986

CVE-2025-11986 affects the WordPress Crypto Tool plugin (

CVE-2025-11986 Crypto Tool <= 2.22 - Unauthenticated Information Exposure via Global Authentication State

The Crypto plugin for WordPress is vulnerable to Information exposure in all versions up to, and including, 2.22. This is due to the plugin registering an unauthenticated AJAX action wpajaxnoprivcryptoconnectajaxprocess that allows calling the register and savenft methods with only a...

CVE-2025-12924

A vulnerability was identified in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224. This issue affects the function GlobalResult of the file src/main/java/com/rymcu/forest/web/api/bank/BankController.java. The manipulation leads to missing authorization. The attack may be initiated...

EUVD-2025-54105

Malicious code in global-harlequin-iguana npm...

EUVD-2025-54103

Malicious code in global-violet-spoonbill npm...

EUVD-2025-54106

Malicious code in global-cyan-hedgehog npm...

MAL-2025-68546 Malicious code in global-violet-spoonbill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c02a8a57e4e3dc1ca4348957c9f7b5a23b0144e10a83155b7ff7d0f43be27746 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...