MAL-2025-160404 Malicious code in miftaiky-arrange-hard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15643be95611624d290c24a1219be3f6d0a0dbe3c9af4e4eb9c72cab61c46c2c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in miftaiky-arrange-hard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15643be95611624d290c24a1219be3f6d0a0dbe3c9af4e4eb9c72cab61c46c2c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-117333

Malicious code in hard-emerald-cardinal npm...

Malicious code in hard-emerald-cardinal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5e44d60c14c51c84d88f48ff15851f928b0fbbc195366643a4d8c0be03783fb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Sogexia Android App 安全漏洞

Sogexia Android App is a payment account management mobile application from Sogexia Luxembourg. A security vulnerability exists in Sogexia Android App that originates from the inclusion of hard-coded encryption keys in the encryptionhelper.dart file...

Use of Hard-coded Credentials

Overview Affected versions of this package are vulnerable to Use of Hard-coded Credentials in the AuthN implementation. An attacker can gain unauthorized access to sensitive information, escalate privileges, and tamper with data by leveraging hard-coded credentials. Remediation Upgrade...

Use of Hard-coded Credentials

Overview Affected versions of this package are vulnerable to Use of Hard-coded Credentials in the AuthN implementation. An attacker can gain unauthorized access to sensitive information, escalate privileges, and tamper with data by leveraging hard-coded credentials. Remediation Upgrade...

EUVD-2025-74586

Malicious code in hardcamelscarlet-90 npm...

Malicious code in hard_mockingbird-appteadev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f442df4706b8500ed0ee8fdf71771f3223d935a880be320b1c80c2471f0b4f7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-79115

Malicious code in hardboobyz3n npm...

Malicious code in hard-turquoise-guineafowl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb0a89cba7a6c8ee6a1100746303a1689f144704c9d14d54cc3851aacfb38f1f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-54008

Malicious code in hard-turquoise-guineafowl npm...

EUVD-2025-54007

Malicious code in hard-turquoise-spider npm...

EUVD-2025-47270

Malicious code in hardcentipedez3n npm...

EUVD-2025-47269

Malicious code in hardkingfisherz3n npm...

CVE-2025-12676

CVE-2025-12676 concerns KiotViet Sync for WordPress (versions up to 1.8.5). According to multiple sources, the root cause is a hard-coded password used for authentication inside QueryControllerAdmin::authenticated, enabling unauthenticated attackers to create and sync products. Public details con...

CVE-2025-12676 KiotViet Sync <= 1.8.5 - Use of Hard-coded Password to Authorization Bypass

The KiotViet Sync plugin for WordPress is vulnerable to authorizarion bypass in all versions up to, and including, 1.8.5. This is due to the plugin using a hardcoded password for authentication in the QueryControllerAdmin::authenticated function. This makes it possible for unauthenticated attacke...

WordPress plugin KiotViet Sync 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blogging sites on PHP and MySQL based servers.WordPress plugin is an application plugin... A security...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989555)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989555 advisory. In the Linux kernel, the following vulnerability has been resolved: s390/qeth: fix NULL deref in qethclearworkingpoollist When qethsetonline calls...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989401)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989401 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/lima: mask irqs in timeout path before hard reset There is a race condition in which a...