84704 matches found
Malicious code in gita-ketan64-sluey (npm)
Source: amazon-inspector 26cc138cfca3d00635d6e364eb8265004dcbc597ff26fdecc604c8c080d539b2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in gita-ketan14-sukiwir (npm)
Source: amazon-inspector ce83814a6e63a83621792911c6e0e5181022883d936212f58f120934fa8be2fb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in gita-kemplang32-sluey (npm)
Source: amazon-inspector bfd51ac5609497a52ba74b1c965a68fae8e8a6a202ad636dd52ad1477245a06e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in gita-kepok69-sluey (npm)
Source: amazon-inspector c88a2f4b930b081ffc5c041f5bd274c83d75b8491a9c7b04369ed2951b50a89d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in gita-keraktelor67-miaww (npm)
Source: amazon-inspector e91064cc1648fdea7dc5be42f3112fa5be8e2198ef9208fe9d8e71d6fa27aca3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in gita-kentang74-miaww (npm)
Source: amazon-inspector 186b7db467757e14f4b1a93dbd1d00358cd67f5e7c7d87da9f798f0b07e2336d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in gita-kacang51-sluey (npm)
Source: amazon-inspector 2b2e467aa7c9f5deb3fe3d8b17c38b00f4629413c77e46568209003203466497 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in gita-kacang71-sukiwir (npm)
Source: amazon-inspector 3d169500aff54efa2d0a447abe5e807fc43ee757d0d18eadbe5498b39a2b5db8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in gita-kacang62-breki (npm)
Source: amazon-inspector 20efaf000064d0e5cbf70b79b633225bead0cd81e1bbbb3e4d3a006d8e253a47 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in gita-kembang4-sukiwir (npm)
Source: amazon-inspector 44ca327af609e9b23493a2fad824ecae4df61314831fc7d3426ccdef25581984 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in gita-kacang59-miaww (npm)
Source: amazon-inspector 76caf648d2ed0cb1501178e4bdac965e3f75a652440fa510ad34eec92bd9990c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in gita-jengkol94-sukiwir (npm)
Source: amazon-inspector 5d3307a932cb3643136de0759e16d656ca343484d5d7a173f4948d1a7671022e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in gita-jengkol9-sluey (npm)
Source: amazon-inspector 4be4045dd9fa6689b11e9e48d461af85195459db10a5bbd993a0b851817b6a42 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libpq (UTSA-2024-000296)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2024-000296 advisory. A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification...
CVE-2026-11355
The DT LMS – elearning WordPress plugin (versions ≤ 1.1) is vulnerable to unauthorized modification of plugin settings due to missing capability checks on multiple AJAX handlers (dtlms_save_poc_settings, dtlms_save_skin_settings, dtlms_save_options_settings). These handlers are registered on the ...
EUVD-2026-76836
The DT LMS – elearning, WordPress LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX handlers including dtlmssavepocsettings, dtlmssaveskinsettings, and dtlmssaveoptionssettings in versions up to, and including, 1.1. Thes...
CVE-2026-11355 DT LMS <= 1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via Multiple AJAX Actions
The DT LMS – elearning, WordPress LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX handlers including dtlmssavepocsettings, dtlmssaveskinsettings, and dtlmssaveoptionssettings in versions up to, and including, 1.1. Thes...
CVE-2026-77705
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the...
CVE-2026-87891 Rox Appointment Booking < 1.2.0 - Unauthenticated Holiday Schedule Modification via REST API
The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates...
