MAL-2025-50008 Malicious code in candra-naget58-devapp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0dbe4ffa9b7e60273fc046e1be020735257146ac4ef35672e3e9749470d51ec3 The package candra-naget58-devapp was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

Malicious code in bella-nasisayur55-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb6bc27455df3d084bd1bdc2c4547fd515609ac9012dc9b196d9b1a48873cf2c The package bella-nasisayur55-breki was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

MAL-2025-50336 Malicious code in erick-tiwul58-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9893ba6a4e7964ed3d002341a5570a1c95db7c60f0621bb50d983cffe72effea The package erick-tiwul58-miaww was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that floode...

Malicious code in cici-ragi93-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2db61514d498dd9617f8b3c7a90a2a207979818f55a7afd828cc9f2cf9246c4a The package cici-ragi93-breki was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...

MAL-2025-50647 Malicious code in vida-brongkos8-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9902bbcd3e3c494423de22a301f50c629df3e2693590945f3e9bd497ab818c66 The package vida-brongkos8-riris was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flood...

MAL-2025-50504 Malicious code in tania-nasipecel70-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d5bb6e197c728ad77fda6ab3cfd98baecbb14c13f040be8ccd147e011591cff The package tania-nasipecel70-sluey was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

Malicious code in erwin-kentang41-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 711b8094383f4f8fc1494fca61fa25d5e5df679371cee39bb8e3a19d312fd9a3 The package erwin-kentang41-riris was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

Malicious code in erwin-lodeh86-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5f2f69849ab6168028f1e1dd808e05d60c997fb82b7a3b09ab91781e88d9616 The package erwin-lodeh86-riris was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that floode...

MAL-2025-52533 Malicious code in udin-teh28-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6e57b63f57d9c5cd72a0c434ea5adb53e418e02752812d3c31df1ac297d805a The package udin-teh28-sluey was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded n...

MAL-2025-50363 Malicious code in fadhil-dradag65-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 362c7e77ef24652c663049c04ca1428888f1b29821eb9eb30feabcab22b1509d The package fadhil-dradag65-riris was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

MAL-2025-51899 Malicious code in fitri-jengkol39-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0468d60b5c42108c52bc5807277e3c8cca80947e22b3a0f5fd8c6665e8e5480b The package fitri-jengkol39-breki was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

MAL-2025-49755 Malicious code in agus-lumpur45-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 021667953c357328a26758f72f5ff71fb757a15e38074eb0ba4e6145678fd6a3 The package agus-lumpur45-riris was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that floode...

Hybrid Fuzzing with LLM-Guided Input Mutation and Semantic Feedback

Software fuzzing has become a cornerstone in automated vulnerability discovery, yet existing mutation strategies often lack semantic awareness, leading to redundant test cases and slow exploration of deep program states. In this work, I present a hybrid fuzzing framework that integrates static an...

OS Command Injection

github.com/chaos-mesh/chaos-mesh is vulnerable to OS command Injection. The vulnerability is due to unsanitized input handling in the cleanTcs mutation due to user-controlled fields being passed to operating-system command execution without proper validation. An attacker can use this to perform...

OS Command Injection

github.com/chaos-mesh/chaos-mesh is vulnerable to OS command injection. The vulnerability is due to improper input validation in the cleanIptables mutation, which allows an unauthenticated in-cluster attacker to execute arbitrary commands and achieve remote code execution across the cluster...

CVE-2025-62645

The Restaurant Brands International RBI assistant platform through 2025-09-06 allows a remote authenticated attacker to obtain a token with administrative privileges for the entire platform via the createToken GraphQL mutation...

CVE-2025-62645

The Restaurant Brands International RBI assistant platform through 2025-09-06 allows a remote authenticated attacker to obtain a token with administrative privileges for the entire platform via the createToken GraphQL mutation...

CVE-2025-62645

The Restaurant Brands International RBI assistant platform through 2025-09-06 allows a remote authenticated attacker to obtain a token with administrative privileges for the entire platform via the createToken GraphQL mutation...

Restaurant Brands International assistant platform 安全漏洞

Restaurant Brands International assistant platform is a restaurant back office platform from Restaurant Brands International. A security vulnerability exists in Restaurant Brands International assistant platform version 2025-09-06 and earlier, which stems from a createToken GraphQL mutation that...

CVE-2025-62645

The RBI assistant platform (Restaurant Brands International) through 2025-09-06 is vulnerable: a remote authenticated attacker can obtain a token with administrative privileges for the entire platform via the createToken GraphQL mutation. The evidence across multiple sources confirms an impersona...