EUVD-2025-111328

Malicious code in meissa-alphard-xanadu-graphql npm...

MAL-2025-146148 Malicious code in phoebe-dactyl-hydra-uglify-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15069d6c517ba07a6ed22a9fc3941b90f3ed7cd9171a1029f4f45dd9c8976e82 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pino-pretty-antares-wolf-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ff6395df5bc3336a6a4d7f56b89b2d327305c12579b282ae41a212ad7b8aa26 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-122291

Malicious code in sagitta-xml-child-process-loopback npm...

EUVD-2025-113328

Malicious code in galaxy-andromeda-non-blocking-xml npm...

How Can We Effectively Use LLMs for Phishing Detection?: Evaluating the Effectiveness of Large Language Model-Based Phishing Detection Models

Large language models LLMs have emerged as a promising phishing detection mechanism, addressing the limitations of traditional deep learning-based detectors, including poor generalization to previously unseen websites and a lack of interpretability. However, LLMs' effectiveness for phishing...

One Signature, Multiple Payments: Demystifying and Detecting Signature Replay Vulnerabilities in Smart Contracts

Smart contracts have significantly advanced blockchain technology, and digital signatures are crucial for reliable verification of contract authority. Through signature verification, smart contracts can ensure that signers possess the required permissions, thus enhancing security and scalability...

Huawei EulerOS: Security Advisory for golang (EulerOS-SA-2025-2358)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-46577

Name of the Vulnerable Software and Affected Versions ViewLead Technology Bacteriology Laboratory Reporting System affected versions not specified Description The Bacteriology Laboratory Reporting System allows unauthenticated remote attackers to inject arbitrary SQL commands, potentially enablin...

WellSky Harmony 安全漏洞

WellSky Harmony is an all-in-one service management platform from WellSky USA. A security vulnerability exists in WellSky Harmony version 4.1.0.2.83, which stems from improper cleanup of the TXTUSERID parameter in the xmHarmony.asp endpoint, which could lead to an SQL injection attack...

StyleBreak: Revealing Alignment Vulnerabilities in Large Audio-Language Models Via Style-Aware Audio Jailbreak

Large Audio-language Models LAMs have recently enabled powerful speech-based interactions by coupling audio encoders with Large Language Models LLMs. However, the security of LAMs under adversarial attacks remains underexplored, especially through audio jailbreaks that craft malicious audio promp...

CVE-2025-12434

Race in Storage in Google Chrome on Windows prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-59499

Improper neutralization of special elements used in an sql command 'sql injection' in SQL Server allows an authorized attacker to elevate privileges over a network...

EUVD-2025-84350

Zohocorp ManageEngine Analytics Plus versions 6170 and below are vulnerable to Unauthenticated SQL Injection due to the improper filter configuration...

CVE-2025-8324 SQL Injection

Zohocorp ManageEngine Analytics Plus versions 6170 and below are vulnerable to Unauthenticated SQL Injection due to the improper filter configuration...

grub2: grub-core/gettext: Integer overflow leads to Heap OOB Write.

A flaw was found in grub2. The calculation of the translation buffer when reading a language .mo file in grubgettextgetstrfromposition may overflow, leading to a Out-of-bound write. This issue can be leveraged by an attacker to overwrite grub2's sensitive heap data, eventually leading to the...

XPath Injection

smolagents is vulnerable to XPath injection. The vulnerability is due to insecure XPath construction due to searchitemctrlf concatenating unsanitized user input into XPath expressions, allowing attackers to inject XPath to bypass filters, access unintended DOM nodes, or disrupt web automation...

Malicious code in statutory_butterfly_0xrequest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 502c925004aa878e6d59d46196b59a53104016061225edd6eaf5d306a2d41701 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-97674 Malicious code in cockroach_blue-64-tisubasah (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2d88ce984e9b31308833bc84a862bf25070a219ac93d4280243e2839b3ef01c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-84643 Malicious code in dian-sate70-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0a91903928f46456e389578b0c21b16257878a493578e36e4fafb601e8c2e57 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...