OESA-2026-1699 golang security update

The Go Programming Language. Security Fixes: The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large...

GO-2026-4352 OpenTofu has High CPU usage in "tofu init" with maliciously-crafted module packages in .zip format in github.com/opentofu/opentofu

OpenTofu has High CPU usage in "tofu init" with maliciously-crafted module packages in .zip format in github.com/opentofu/opentofu...

CVE-2025-68119 Unexpected code execution when invoking toolchain in cmd/go

Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial hg installed, downloading modules from non-standard sources e.g., custom domains can cause unexpected code execution due to how external VCS commands are constructed. This iss...

EUVD-2025-202933

WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerability that allows administrators to upload malicious modules. Attackers can craft a specially designed ZIP module with embedded PHP reverse shell code to gain remote system access when the module is installed...

CVE-2025-34506

WBCE CMS is affected: version 1.6.3 and earlier are vulnerable to authenticated remote code execution via uploading a malicious module. The flaw arises when an administrator can upload a ZIP module containing embedded PHP reverse shell code, enabling remote system access when installed. Exploitat...

Exploit for CVE-2025-55182

CVE-2025-55182 Raw HTTP Requests to exploit the insecure lazy...

Malicious code in module-barnard-ganymede-sociobiology (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 318ce5e99a1844c93f91036e8137e440098fae0a90415e943e5bb1c3a0a191af This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in @miptaa02/saysa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3950aa4c6b2e241032854e9a69cb9041baa2051bb89588ccd4387bce177771df This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in inquirer-cli-hermes-commitizen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e24b115a829d16b3956d1bc125c8001900849f9d2adfba59701f7f3a09299ce This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145097 Malicious code in module-algol-npm-quantum (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6df4076437c513112089b53d9a85ce5172d0f134afb19ff5def94fb7a291385f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kurniawan-rangi26-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 378a7c061bd6dd6337d5c724eace2d0d133d1102330530571b3fe00b554bb4ec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-128042 Malicious code in kurniawan-dodol13-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cebdc217593687718415a67ea65926d2a294397b211a5e6a0f827b4bdc4be58e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-91046

Malicious code in intimateboobyz3n npm...

MAL-2025-108209 Malicious code in rough_tarantula_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66288a80f08f582676d3edd0dac24daa62ad4f41033219812d321cea824a9532 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-81752 Malicious code in tremendous_loon_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55030e5e21dc9da6e9e2170ca5bca14f1244d9fc7266f5062b1f063ea486ef4d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-82396 Malicious code in willing_marten_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3cbc420500015fa0a98a387172e426c147e9a26f5318c92a7a246ea9931f7c6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ogi-kue16-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef9bcb6acd650f831c996518fd867b7537b412deae4c06b4b4f7969367d2ce4c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-38039

OpenTofu affected denials of service in "tofu init" with maliciously-crafted module package responses...

Privilege Escalation

PyInstaller is vulnerable to Privilege Escalation. The vulnerability is due to the bootstrap process appending a special entry to sys.path and attempting to load an optional bytecode-decryption module while that entry is present, which allows an attacker who can create files/directories next to t...

CVE-2025-49655

Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file containing a TorchModuleWrapper class to run arbitrary code on an end user’s system when loaded despite safe mode being...