CVE-2026-59247 Insufficient verification of Hex package metadata in Gleam

Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolution. During dependency resolution Gleam fetches package metadata from the signature-verified Hex repository, which covers each...

firefox: thunderbird: Unhandled Exception in Add-on Signature Verification

The Mozilla Foundation's Security Advisory: The application can fail to account for exceptions thrown by the loadManifestFromFile method during add-on signature verification. This flaw is triggered by an invalid or unsupported extension manifest and could cause runtime errors that disrupt the...

CVE-2026-38429

OpenCMS v20 and before is vulnerable to XML External Entity XXE in the Admin Import DB feature due to insecure XML parsing of user supplied .zip files containing a manifest.xml...

CVE-2026-38429

OpenCMS v20 and before is vulnerable to XML External Entity XXE in the Admin Import DB feature due to insecure XML parsing of user supplied .zip files containing a manifest.xml...

CVE-2026-38429

OpenCMS v20 and before is vulnerable to XML External Entity XXE in the Admin Import DB feature due to insecure XML parsing of user supplied .zip files containing a manifest.xml...

CVE-2026-28673

xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the standard plugin system allows admins to upload a ZIP file containing a binary and a manifest.json. The server trusts the binaries field in the manifest and execute...

CVE-2026-28673

xiaoheiFS (self-hosted financial/operational system) versions ≤ 0.3.15 are vulnerable through the standard plugin system. An attacker can upload a ZIP containing a binary and a manifest.json; the server trusts the binaries field in the manifest and executes the specified file without validating i...

PT-2026-25970

xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the standard plugin system allows admins to upload a ZIP file containing a binary and a manifest.json. The server trusts the binaries field in the manifest and execute...

EUVD-2026-12085

JumpServer is an open source bastion host and an operation and maintenance security audit system. a Server-Side Template Injection SSTI vulnerability exists in JumpServer's Applet and VirtualApp upload functionality. This vulnerability can only be exploited by users with administrative privileges...

MAL-2025-190150 Malicious code in view-omicron-unix-compress-authorize (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d86eb2e159a609113cfc2efc8435ff741a9e4a3d864ae507fe6a729dd0058b3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in itale-adci-ggryuyegfjbu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c49bb2df6a5269b255f6360543df1a830c0ad775c6f1398eddbd88b8a21ef42 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-184952 Malicious code in sonic-kas-fagiufagugafa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9a537d26a3f1602b0d32cd0629586d1858929097fd1dd03ca591b48867e6125 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-py-kopna (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 350372ec686d2e9f3d5e3041efd1ae292241b88f94b8391dacabfd5194b3805d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-futfi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9069dc632d842e20a9ba5d0cd40085a754cfdc82ebf69f2427dc7e942ed583dd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-180993 Malicious code in teate-thy-sonic-tutato (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5037addecd0179ab192604db30cede8138b42b47a3391ce3403c48ca1f73e72 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-181154 Malicious code in teate-thy-sonic-zuluf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d198dc0693a9d57cb4fcf20d4c644a5a1a662b95d255e2d4fa7f74603234d2a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-178629 Malicious code in savion-goodmn-max (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 797fcc13318e5b4aa370b9f23fcb53f13e4db299ad64e630f99f82d4e074ae67 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-179193 Malicious code in traay-pazap-paoim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ee1b3ab8390352c288a29cf58c99fecb3c6ddb4b45901fb87b33c679e7fff9c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in unimana-satgub-naiuanab (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5174efd6ecdaa186069b309f2af05c5bf6dd72df338d032de7ec1d2d38eddca This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in goodain-nusafaia-nuasafi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16aa6ae8a5a64c001441544f5edc0085a5a34c595b82f25b5661452a38b99f1a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...