MAL-2025-70243 Malicious code in redundant-apricot-goose (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ad842ebb3fc7d678631d2a6e474070faf44e64828321f29659cf571412b7242 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hanafi-telurtahu72-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2748632875a82036827092a9201573ac4dad04ed7854a3d6e5bce6edff4f1270 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rifqi-gaplek65-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2fa4ee5b1f27d92aba7c920a577b7a4da239591f7958f5a3f344b064ba5eb11 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-66181 Malicious code in wibowo-tahu32-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c067a86d952e6444a8c884cfe46bfbab3aac236864c529e16d0c92b66a0a27d4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-61721 Malicious code in absolute_scallop_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44e676bfffea9c53aa1fa41ff92720aadb74ea08869fb8259338db80688b66d9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in weary_prawn_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 568d01c45358e9fa1ccef686a3810fed8c6b29c7046f0b8c81c1d09f2f6fbcf7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dewi-lupis59-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 374b3f2325d16fc58715c39bb7400e6c36912a35b7cb4a519f47ac8dace39ade This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nuclear_gazelle_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf685243db07a3caa77f7d18b62d449c971dda664851a12c62c07487cc9d0e25 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in oktafian-mieayam41-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9123562497f15204d9483ae778abbcc5960405f06ed61373cb9fc430cdf82d0a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-25434

Malicious code in bioql PyPI...

EUVD-2023-28016

Malicious code in bioql PyPI...

CVE-2025-9696 Use of Hard-coded Credentials in SunPower PVS6

The SunPower PVS6's BluetoothLE interface is vulnerable due to its use of hardcoded encryption parameters and publicly accessible protocol details. An attacker within Bluetooth range could exploit this vulnerability to gain full access to the device's servicing interface. This access allows the...

CVE-2025-54792

LocalSend is an open-source app to securely share files and messages with nearby devices over local networks without needing an internet connection. In versions 1.16.1 and below, a critical Man-in-the-Middle MitM vulnerability in the software's discovery protocol allows an unauthenticated attacke...

Absolute Secure Access 安全漏洞

Absolute Secure Access is an application from Absolute, Inc. to provide Secure Service Edge SSE optimized for hybrid and mobile working models. A security vulnerability exists in versions prior to Absolute Secure Access 13.56, which stems from a privilege bypass that could result in improperly...

PT-2025-13526

Name of the Vulnerable Software and Affected Versions saTECH BCU firmware version 2.1.3 Description The issue is related to a cross-site request forgery CSRF vulnerability in the web application, which could allow an unauthenticated local attacker to exploit active administrator sessions and...

CVE-2025-2863: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the web application of saTECH BCU firmware version 2.1.3, which could allow an unauthenticated local attacker to exploit active administrator sessions and perform malicious actions. The malicious actions that can be executed by the attacker depend ...

PT-2024-35811 · Fcnt · Fcnt Android

Name of the Vulnerable Software and Affected Versions: FCNT Android devices affected versions not specified Description: The issue concerns the exposure of security settings on FCNT Android devices when the screen is unlocked by a user and an attacker can directly operate the device. This can lea...

CVE-2024-50650

The python_book online book lending and book management system, version V1.0 , is vulnerable to Incorrect Access Control (CWE-863). An attacker can exploit this flaw by modifying the ID parameter to obtain sensitive information belonging to users with different IDs. As of the current documentatio...

How should <selectedoption> work?

We're finally getting a way to fully style & customise elements! But there's a detail I'd like everyone's opinion on. Update: Your feedback was heard, and folks have agreed to change the behaviour here. See the update below. A brief intro to customisable If you want to hear about it in depth, I...

How should work?

We're finally getting a way to fully style & customise elements! But there's a detail I'd like everyone's opinion on. A brief intro to customisable If you want to hear about it in depth, I talked about it on OTMT, and there's a great post by Una Kravets. But here's a whirlwind tour: / Opt in to t...