EUVD-2025-52707

Malicious code in possible-azure-bass npm...

Malicious code in possible-tomato-cockroach (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7894f4f3576eefc718fb1229726634dbe3095c6d79a9c469863d50c784dcb120 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in possible-indigo-cheetah (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4e42f7bb2da584bb623dcfe3deb3d494474369a7511cc67c356e3647c5c6c27 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-52709

Malicious code in possible-amaranth-mammal npm...

MAL-2025-69942 Malicious code in possible-azure-bass (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 291d208eaa6b72def61ffdbcde0cbd3915954a8ac0e9f0bd9ee92fc03cf130f1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-12922

A vulnerability was found in OpenClinica Community Edition up to 3.12.2/3.13. This affects an unknown part of the file /ImportCRFData?action=confirm of the component CRF Data Import. Performing manipulation of the argument xmlfile results in path traversal. The attack can be initiated remotely. T...

CVE-2025-13015

Spoofing issue in Firefox. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, and Firefox ESR 115.30...

CVE-2025-13027

Memory safety bugs present in Firefox 144 and Thunderbird 144. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 145 and Thunderbird 145...

EUVD-2025-49621

Malicious code in possibledeerz3n npm...

EUVD-2025-49622

Malicious code in possiblecobraz3n npm...

EUVD-2025-49620

Malicious code in possibleroadrunnerz3n npm...

MAL-2025-58165 Malicious code in possible_locust_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d78feab22bd48f98139f3424f6a7180aeffdb2cc2e5b60e5190501e6f496cbe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-45811

Malicious code in possiblebassz3n npm...

EUVD-2025-45810

Malicious code in possiblelocustz3n npm...

EUVD-2025-38255

A vulnerability has been found in DedeBIZ up to 6.3.2. This impacts an unknown function of the file /admin/templetsoneedit.php. The manipulation of the argument ids leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used...

CVE-2025-43419

The issue was addressed with improved memory handling. This issue is fixed in Safari 26, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. Processing maliciously crafted web content may lead to memory corruption...

Exploit for Server-generated Error Message Containing Sensitive Information in Squid-Cache Squid

CVE-2025-62168Squid Proxy Information Disclosure in Error hand...

Ubuntu 22.04 LTS / 24.04 LTS / 25.04 / 25.10 : X.Org X Server vulnerabilities (USN-7846-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.04 / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7846-1 advisory. Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled certain memory operations. An attacker could use these...

Malicious code in eslint-disable-next-line (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c260c70270e5f716b6e8197913327633d64aa0ee2e18ebde88c8f53f06893c62 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48954 Malicious code in @acme-types/acme-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f1b754e0118dde98a24e6f1ea46eb2ed30d7b59cd938fbc627e6dc4429251482 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...