Malicious code in karma-quasar-io-europa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 901fba8e53336890c2a909220698dc02d13850830f1b1fd4621a31308f933e7f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-12019

The Featured Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image metadata in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions an...

Malicious code in near_owl_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae380128e7d87d2b82ad55d13198e6560306659f85226e358b62b95cecfbad44 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tasty_ostrich_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aba02bcf6bc040b83ba7e5e10df0a1bf19605012adf3ca501bb8edb7401b82ea This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in smart-tan-jackal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6346393ce37cb8b00d5201fae5e8b195ce2de523c7d24b265a68e3f23021174e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in late-white-whale (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90eb10c7af4c8cef448526af282d5089bb64071b81a7fe476c4f005710c560fb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in potential-salmon-snake (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b710994e484177da233d848af8e1549c3b277f9d7efcf01c868add0e2abb1d8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138989 Malicious code in running-chocolate-lynx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffb77eade9c851555770d34c459c181ac2b42fd29241f721bf91dcd1693e23d1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mammoth-brown-mink (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0cfac41640fd80e5a53b1801bc8d9c150c5fd613bbb318bc5064c0781c6477db This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in unknown-white-cricket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb81dd3f6a1c64968e6d832222379c22d81a0d68cdbb8d92aee62cd51375d7b0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138837 Malicious code in liloyst (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1fc931892e1340a03042f91e1ca48d04171168fa64ec768aed1aa592f2efd6d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in immense-olive-octopus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02656cceb4e7ac01cccd5f7f32289d5e16a49c1b8bc908aaa45b22a06f90fc0a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in orthodox-blue-mastodon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ecdd7fccdbeb5a8a860588776e90de4bc8e90a50771100a4fd66e0ab1999495d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139057 Malicious code in surrounding-olive-caribou (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51b64e4a56a725b2726b1b2ca6dbf6ccc1754bd55922937806bafbfc7344cb02 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138717 Malicious code in fascinating-coral-marlin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c8f65e9fdaf8502289c4e3097788b192701db6d4ed046852d818449c6ab10a4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

libtiff: Libtiff Write-What-Where

A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file. By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controll...

kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy

In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfsmdtdestroy In allocinode, inodeinitalways could return -ENOMEM if securityinodealloc fails, which causes inode-iprivate uninitialized. Then nilfsismetadatafileinode returns true and nilfsfreeinode...

CVE-2025-42919

Due to an Information Disclosure vulnerability in SAP NetWeaver Application Server Java, internal metadata files could be accessed via manipulated URLs. An unauthenticated attacker could exploit this vulnerability by inserting arbitrary path components in the request, allowing unauthorized access...

EulerOS 2.0 SP12 : python3 (EulerOS-SA-2025-2370)

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some fil...

PT-2025-46693

Name of the Vulnerable Software and Affected Versions IBM OpenPages versions 9.0 through 9.1 Description IBM OpenPages versions 9.0 and 9.1 have a security issue that could lead to the disclosure of sensitive information. This is due to insufficient security measures on certain REST API endpoints...