EUVD-2025-81145

Malicious code in mutualtortoisedumbs npm...

Malicious code in mutual_roadrunner_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18c229fe70caf54e26772c8448eb5ce1946c234140456e8e22593e3405e5ad97 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mutual_ladybug_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f806867a376baf43b920c5d48102c4d98b605aa2112a248112e4ce650ecdcbe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-84673

Malicious code in mutualblackbirdz3n npm...

EUVD-2025-84670

Malicious code in mutualroadrunnerz3n npm...

MAL-2025-80101 Malicious code in mutual_wildfowl_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2e8ba5bfbc65e722605bb183a6c39095c3f08707022537bf3e3c04d9d33b3c1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-53132

Malicious code in mutual-salmon-constrictor npm...

EUVD-2025-53131

Malicious code in mutual-tomato-platypus npm...

EUVD-2025-53134

Malicious code in mutual-cyan-mackerel npm...

EUVD-2025-53136

Malicious code in mutual-blush-lion npm...

EUVD-2025-53133

Malicious code in mutual-plum-stoat npm...

MAL-2025-69518 Malicious code in mutual-tomato-platypus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 771d66fbf6fcd72ddc3198e742cb9c5526a336ff4af02f2bfee042a78d03c8c1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-53135

Malicious code in mutual-cyan-bug npm...

MAL-2025-69513 Malicious code in mutual-blush-lion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc6be8e8a611a4c10be1b762ee7b83a9b1948a4bcc3f1ead38c2a3e57a869e37 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

AZL-69890 CVE-2025-64432 affecting package kubevirt for versions less than 0.59.0-33

KubeVirt is a virtual machine management add-on for Kubernetes. Versions 1.5.3 and below, and 1.6.0 contained a flawed implementation of the Kubernetes aggregation layer's authentication flow which could enable bypass of RBAC controls. It was discovered that the virt-api component fails to...

AZL-69793 CVE-2025-64432 affecting package kubevirt for versions less than 1.5.3-2

KubeVirt is a virtual machine management add-on for Kubernetes. Versions 1.5.3 and below, and 1.6.0 contained a flawed implementation of the Kubernetes aggregation layer's authentication flow which could enable bypass of RBAC controls. It was discovered that the virt-api component fails to...

CVE-2025-64432

CVE-2025-64432 affects KubeVirt, specifically the virt-api component, where the mTLS authentication flow fails to validate the CN field in client certificates against the extension-apiserver-authentication config, enabling potential RBAC bypass by communicating directly with the aggregated API se...

CVE-2025-64432 KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer

KubeVirt is a virtual machine management add-on for Kubernetes. Versions 1.5.3 and below, and 1.6.0 contained a flawed implementation of the Kubernetes aggregation layer's authentication flow which could enable bypass of RBAC controls. It was discovered that the virt-api component fails to...

CVE-2025-64432 KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer

KubeVirt is a virtual machine management add-on for Kubernetes. Versions 1.5.3 and below, and 1.6.0 contained a flawed implementation of the Kubernetes aggregation layer's authentication flow which could enable bypass of RBAC controls. It was discovered that the virt-api component fails to...

GHSA-GGP9-C99X-54GP KubeVirt's Improper TLS Certificate Management Handling Allows API Identity Spoofing

Summary Due to improper TLS certificate management, a compromised virt-handler could impersonate virt-api by using its own TLS credentials, allowing it to initiate privileged operations against another virt-handler. Details Give all details on the vulnerability. Pointing to the incriminated sourc...