GO-2026-5499 Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project in github.com/nuclio/nuclio

Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project in github.com/nuclio/nuclio...

Missing Authorization

Overview @vitest/ui is an UI for Vitest Affected versions of this package are vulnerable to Missing Authorization through the api and browser.api request handlers in the server and UI components. An attacker can run tests, modify project files, or overwrite snapshots by connecting to an exposed...

MAL-2025-181024 Malicious code in teate-thy-sonic-urapu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9380cef82872e3ccdee7e5519c2ab04e168ed707dc179e1ee4a94ae82672d4a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-176587 Malicious code in nuilva-avm-rucasiva (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5bb806950b93c7f942d8cf226ea765feddcd582eb86f50200234aa33042f46f4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-155900 Malicious code in ican-poke23 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bff3d3ae7cc9acba1782d8ce836464dfbfdf25e260114f7da8c9a36ab7d4350 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-157178 Malicious code in jurss-gasd-as10as (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e115af794b2394611505c7949e9641e6644fcbe1add0f10c40c46492b75f09aa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141004 Malicious code in concurrently-deimos-scorpius-kaus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 417930b3a430052e342e5f69a99cbf6ba77c60440316b9ce057c1d09105f7c73 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mute_tern_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f17f8bae7c44e5dfab5abe30de89768d27051561438bd3a88812feb1add8302 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in oktafian-bika19-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d2d23a762fa109007e9ef4d462af47d510e29d66b77758f1adffcb68e4d8877 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tasty_cardinal_dumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d6d7042482402b3b24a95fa30e0e936a25a249643bd8b0f5a375a43939480e0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-108033 Malicious code in riana-nasi62-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05b50574c09d0f768908483af0506862c7ee39b902fc270dba6bfd0e03a8733d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in qori-bakwan74-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c25ccf9a40c52095cb8303ff6756cd670f80963a5bc7d6e88519c498948bdcf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-83113 Malicious code in agus-ubi33-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac7b81a7496fef0c12f7d192dd8ccc6655376a12ae2cfe7b360b1371182cc5c8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-69061 Malicious code in large-fuchsia-wasp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d1062a47ed1f2271a0fdb57d02fb2c0e5cfaf128936e54cda914bcb6a251405 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-64703 Malicious code in oktafian-gepuk80-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bdbcb845bb5a80065804364342b7ab922887fd527b872c8aba40bd8a1ddbc2a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-61471 Malicious code in thoughtful_vicuna_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e3265ba9d89dea383b18462301f595c36ca4f0df8f288c61d3c088715d94644 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Cybozu Office Restriction Bypass Vulnerability

Cybozu Office is a Web-based, cross-platform collaboration solution from Cybozu. A security vulnerability exists in Cybozu Office versions 9.0.0 through 10.4.0. An attacker can exploit the vulnerability to modify project information...