Malicious code in cici-ragi93-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2db61514d498dd9617f8b3c7a90a2a207979818f55a7afd828cc9f2cf9246c4a The package cici-ragi93-breki was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...

Malicious code in vera-lengko64-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23f32bdea1c4e2e439f218c84a0063f9b420119757dc13f69d2dd67b807d2062 The package vera-lengko64-ruro was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...

Malicious code in fauzi-keripik13-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 045a0a7fcca6f21c5479332bfd9c7faeaab56b09f24cc100529806825a9006ef The package fauzi-keripik13-riris was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

Malicious code in erwin-kentang41-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 711b8094383f4f8fc1494fca61fa25d5e5df679371cee39bb8e3a19d312fd9a3 The package erwin-kentang41-riris was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

MAL-2025-50336 Malicious code in erick-tiwul58-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9893ba6a4e7964ed3d002341a5570a1c95db7c60f0621bb50d983cffe72effea The package erick-tiwul58-miaww was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that floode...

MAL-2025-50504 Malicious code in tania-nasipecel70-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d5bb6e197c728ad77fda6ab3cfd98baecbb14c13f040be8ccd147e011591cff The package tania-nasipecel70-sluey was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

MAL-2025-50647 Malicious code in vida-brongkos8-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9902bbcd3e3c494423de22a301f50c629df3e2693590945f3e9bd497ab818c66 The package vida-brongkos8-riris was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flood...

MAL-2025-50008 Malicious code in candra-naget58-devapp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0dbe4ffa9b7e60273fc046e1be020735257146ac4ef35672e3e9749470d51ec3 The package candra-naget58-devapp was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

MAL-2025-49755 Malicious code in agus-lumpur45-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 021667953c357328a26758f72f5ff71fb757a15e38074eb0ba4e6145678fd6a3 The package agus-lumpur45-riris was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that floode...

Malicious code in umi-oncom76-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dc5d3f016bf716e08b7f4c213fb11259b27ddd46fb1fe0385a0bd5ccc3bf762 The package umi-oncom76-miaww was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...

CVE-2025-63783: Improper Input Validation

A Broken Object Level Authorization BOLA vulnerability was discovered in the tRPC project mutation APIs update, delete, add/remove tag of the Onlook web application 0.2.32. The vulnerability exists because the API fails to verify the ownership or membership of the currently authenticated user for...

Hybrid Fuzzing with LLM-Guided Input Mutation and Semantic Feedback

Software fuzzing has become a cornerstone in automated vulnerability discovery, yet existing mutation strategies often lack semantic awareness, leading to redundant test cases and slow exploration of deep program states. In this work, I present a hybrid fuzzing framework that integrates static an...

OS Command Injection

github.com/chaos-mesh/chaos-mesh is vulnerable to OS command Injection. The vulnerability is due to unsanitized input handling in the cleanTcs mutation due to user-controlled fields being passed to operating-system command execution without proper validation. An attacker can use this to perform...

OS Command Injection

github.com/chaos-mesh/chaos-mesh is vulnerable to OS command injection. The vulnerability is due to improper input validation in the cleanIptables mutation, which allows an unauthenticated in-cluster attacker to execute arbitrary commands and achieve remote code execution across the cluster...

CVE-2025-62645

The Restaurant Brands International RBI assistant platform through 2025-09-06 allows a remote authenticated attacker to obtain a token with administrative privileges for the entire platform via the createToken GraphQL mutation...

CVE-2025-62645

The Restaurant Brands International RBI assistant platform through 2025-09-06 allows a remote authenticated attacker to obtain a token with administrative privileges for the entire platform via the createToken GraphQL mutation...

CVE-2025-62645

The Restaurant Brands International RBI assistant platform through 2025-09-06 allows a remote authenticated attacker to obtain a token with administrative privileges for the entire platform via the createToken GraphQL mutation...

EUVD-2025-34928

The Restaurant Brands International RBI assistant platform through 2025-09-06 allows a remote authenticated attacker to obtain a token with administrative privileges for the entire platform via the createToken GraphQL mutation...

CVE-2025-62645: Incorrect Privilege Assignment

The Restaurant Brands International RBI assistant platform through 2025-09-06 allows a remote authenticated attacker to obtain a token with administrative privileges for the entire platform via the createToken GraphQL mutation...

CVE-2025-62645

The RBI assistant platform (Restaurant Brands International) through 2025-09-06 is vulnerable: a remote authenticated attacker can obtain a token with administrative privileges for the entire platform via the createToken GraphQL mutation. The evidence across multiple sources confirms an impersona...