MAL-2025-97674 Malicious code in cockroach_blue-64-tisubasah (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2d88ce984e9b31308833bc84a862bf25070a219ac93d4280243e2839b3ef01c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-89737 Malicious code in putri-oncom20-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2492eeb168d915836c877df8eee5fe714ef452e3c02e3e00a0e769ef0fec331 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-84643 Malicious code in dian-sate70-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0a91903928f46456e389578b0c21b16257878a493578e36e4fafb601e8c2e57 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bambang-martabak65-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3514c8d58d850d3895d9c1137b40c9bb38f27a67669f01f992a5f71787fe9e01 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wibowo-tek1-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc9fccff2781eef88f2fe90ad97de4b974517d86521000e5c96ea3bc63ac92d0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-87048 Malicious code in joko-gaplek75-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 897f5a51defdf744199cabc567e55917e31653e92d867f822c3a0665e69611e6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in putri-oblok13-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff9bd7cd7b72922d2490a4fb6027282e52076325bbde485bb67eeececd4a0502 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in andi-lapis51-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96a280dabecf462a6a1bedf4c68818a30315cfaad6436c8aed14f622a35d8c0e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-12927

A security vulnerability has been detected in DedeBIZ up to 6.3.2. The impacted element is an unknown function of the file /admin/archivesadd.php. Such manipulation of the argument flags leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may b...

Malicious code in gilang-ubi37-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb6e187f69a31fc2f731b6af3e790e01d8528fd30288441512b5ebf89156e2d1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-72736 Malicious code in erick-brengkes75-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba236b4490badfb2ee6d1da615e036d8e5cbea0005bb22b73b9cf9886e8f77f2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in soft-jade-takin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22d760d82d6cf5c00e004c217760aac7e00abd68e29199fff3fc9712d4724483 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-42889

CVE-2025-42889 affects SAP Starter Solution. An authenticated attacker can execute crafted database queries, exposing the back-end database. Impact is described as low for confidentiality and integrity, with no availability impact. Multiple connected sources (NVD/Red Hat/NCSc/CVE listing) confirm...

From LLMs to Agents: A Comparative Evaluation of LLMs and LLM-Based Agents in Security Patch Detection

The widespread adoption of open-source software OSS has accelerated software innovation but also increased security risks due to the rapid propagation of vulnerabilities and silent patch releases. In recent years, large language models LLMs and LLM-based agents have demonstrated remarkable...

PT-2025-46353

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 145 Firefox ESR versions prior to 140.5 Firefox ESR versions prior to 115.30 Description A mitigation bypass exists in the DOM: Core & HTML component. This issue could allow for bypassing security mitigations...

WordPress Easy Email Subscription plugin SQL Injection Vulnerability

WordPress Easy Email Subscription plugin is a plugin for adding email subscription functionality to your WordPress website. WordPress Easy Email Subscription plugin suffers from a SQL injection vulnerability that stems from the application's lack of validation of externally entered SQL statements...

Advantech WebAccess/VPN AjaxDeviceController.ajaxDeviceAction function SQL injection vulnerability

Advantech WebAccess/VPN is a virtual private network feature integrated in Advantech WebAccess/SCADA software, designed to provide a secure and reliable network connectivity solution for industrial automation and remote monitoring systems. Advantech WebAccess/VPN suffers from a SQL injection...

WordPress Plugin CoSchool LMSSQL Injection Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. A SQL injection vulnerability exists in the WordPress plugin CoSchool LMS, which stems from the...

Google Chrome Misimplementation Vulnerability (CNVD-2026-07246)

Google Chrome is a web browser developed by Google Inc. Google Chrome suffers from an improper implementation vulnerability that stems from an improper implementation in V8. An attacker could exploit this vulnerability by exploiting a heap corruption vulnerability via a carefully constructed HTML...

Mozilla Firefox和Mozilla Firefox ESR 安全漏洞

Mozilla Firefox is an open source web browser.Mozilla Firefox ESR is an extended support version of Firefox web browser. A security bypass vulnerability exists in Mozilla Firefox and Firefox ESR, which can be exploited by attackers to bypass security restrictions...