Malicious code in old_duck_0xrequest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5838601645a9b2a62f11876b4c3f6f64098b9b5a076c665cb7276c74aa505e19 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in old_unicorn_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9ed7cb98b6b8f2a4a7ac4832448c129cc5163436cd80c31d7acd24f186b471e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-62808

Malicious code in oldunicornz3n npm...

MAL-2025-95744 Malicious code in old_carp_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4c6cef7141eba3a29814b1bd3ee560e1422a6608497b5e4cb9637dff60c1c34 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-52939

Malicious code in old-peach-crocodile npm...

MAL-2025-69710 Malicious code in old-peach-crocodile (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b96238dc96f227e1e070f9a42d86ff2abba25b4e9ca0b80e7eb4639f7f8d52bb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-52938

Malicious code in old-peach-hummingbird npm...

Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2025-20558)

The remote Oracle Linux 10 / 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-20558 advisory. 6.12.0-103.40.4.2.el10uek - x86/vmscape: Warn when STIBP is disabled with SMT Pawan Gupta Orabug: 38343659 - x86/bugs: Move cpubugssmtupdate down Pawan...

CVE-2025-64513 Milvus Proxy has Critical Authentication Bypass Vulnerability

Milvus is an open-source vector database built for generative AI applications. An unauthenticated attacker can exploit a vulnerability in versions prior to 2.4.24, 2.5.21, and 2.6.5 to bypass all authentication mechanisms in the Milvus Proxy component, gaining full administrative access to the...

CVE-2025-64183

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.2.0 through 3.2.4, 3.3.0 through 3.3.5, and 3.4.0 through 3.4.2, there is a use-after-free in PyObjectStealAttrString of pyOpenEXRold.cpp...

CVE-2025-12728

Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-12428

Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. Chromium security severity: High...

EUVD-2025-49700

Malicious code in oldtermitez3n npm...

EUVD-2025-45886

Malicious code in oldearwigz3n npm...

thunderbird: firefox: Cross-process information leaked due to malicious IPC messages

A flaw was found in Thunderbird and Firefox. The Mozilla Foundation's Security Advisory describes the following issue: A compromised web process using malicious IPC messages could have caused the privileged browser process to reveal blocks of its memory to the compromised process...

CVE-2025-62161 youki container escape via "masked path" abuse due to mount race conditions

Youki is a container runtime written in Rust. In versions 0.5.6 and below, the initial validation of the source /dev/null is insufficient, allowing container escape when youki utilizes bind mounting the container's /dev/null as a file mask. This issue is fixed in version 0.5.7...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989189)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989189 advisory. In the Linux kernel, the following vulnerability has been resolved: xen-netfront: Fix NULL sring after live migration A NAPI is setup for each network sring to poll...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989400)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989400 advisory. In the Linux kernel, the following vulnerability has been resolved: mmmremap.c: avoid pointless invalidaterangestart/end on mremapoldsize=0 If an mremap syscall with...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: drm/mediatek: Added error handling for the old state CRTC in atomicdisable. Introduced error handling to address a issue where, after a hotplug event, the cursor continues to update. This situation can lead to a kernel panic d...

CVE-2025-64386 HIJACKING OF THE TOKEN AND GAINING ACCESS

The equipment grants a JWT token for each connection in the timeline, but during an active valid session, a hijacking of the token can be done. This will allow an attacker with the token modify parameters of security, access or even steal the session without the legitimate and active session...