MAL-2025-146738 Malicious code in proxima-shelljs-rate-limiter-standard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b3dc1868def93642482dc1cde7445a3203c79d579a7682f4e895658766993e0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147190 Malicious code in rehype-typeorm-rate-limiter-koa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d96fef6502b7d80768f460d033cc48a5035c10338d164870a174486af09ced8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143573 Malicious code in indus-perseus-publish-rate-limiter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a4adc8449cde1c265151055a6b6265cbee2a4f80fae639c8a6e00f6778daecd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146958 Malicious code in quasar-rate-limiter-changelog-aquarius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7fc9114b2a03607eceb91b226e779174e19177fa53be111b25fcc6cce8a74c5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143261 Malicious code in helmet-rate-limiter-superagent-umbra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4ef1f11565aefa5ef4b769785a04189915aa6acbcbe8bc7e233fc7c62924926 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

JPRO: Automated Multimodal Jailbreaking Via Multi-Agent Collaboration Framework

The widespread application of large VLMs makes ensuring their secure deployment critical. While recent studies have demonstrated jailbreak attacks on VLMs, existing approaches are limited: they require either white-box access, restricting practicality, or rely on manually crafted patterns, leadin...

Mexico City Is the Most Video-Surveilled Metropolis in the Americas

Despite 83,000 public cameras, crime in Mexico City remains high—and widespread surveillance raises myriad ethical issues...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988693)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988693 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/vrr: Set VRR capable prop only if it is attached to connector VRR capable property is not...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990313)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990313 advisory. In the Linux kernel, the following vulnerability has been resolved: net/sched: schtaprio: fix possible use-after-free syzbot reported a nasty crash 1 in nettxaction...

Improper Resource Management

Dragonfly is vulnerable to Improper Resource Management. The vulnerability is due to the processPieceFromSource method failing to update the usedTraffic field because of an uninitialized variable, which allows an attacker to exploit incorrect rate limiting and cause a denial-of-service condition...

PT-2026-36838

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A transient denial of service DOS occurs when processing target power rate tables during channel configuration. Recommendations At the moment, there is no...

CVE-2025-12094

The OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments No CAPTCHA plugin for WordPress is vulnerable to IP Header Spoofing in all versions up to, and including, 1.2.53. This is due to the plugin trusting client-controlled forwarded headers such as CF-Connecting-IP, X-Forwarded-For,...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: Ensure that ptprate is not 0 before configuring timestamping The stmmac platform drivers that do not open-code the clkptprate value after retrieving the default value from the device-tree may end up setting clkptprat...

Improper Control of Interaction Frequency

Overview django-smart-ratelimit is an A flexible and efficient rate limiting library for Django applications Affected versions of this package are vulnerable to Improper Control of Interaction Frequency due to reliance on hard-coded static and media in the RateLimitMiddleware and the ratelimit...

CVE-2025-34249

Nagios Fusion versions prior to 2024R2.1 contain a brute-force bypass in the Two-Factor Authentication 2FA implementation. The application did not properly enforce rate limiting or account lockout for repeated failed 2FA verification attempts, allowing a remote attacker to repeatedly try...

CVE-2025-12094

The OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments No CAPTCHA plugin for WordPress is vulnerable to IP Header Spoofing in all versions up to, and including, 1.2.53. This is due to the plugin trusting client-controlled forwarded headers such as CF-Connecting-IP, X-Forwarded-For,...

CVE-2025-12094

Summary of CVE-2025-12094 (WordPress OOPSpam Anti-Spam plugin) : The WordPress plugin is vulnerable to IP header spoofing due to trusting client-controlled forwarded headers (e.g., CF-Connecting-IP, X-Forwarded-For) without verifying their provenance. This affects all versions up to and including...

CVE-2025-12094 OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) <= 1.2.53 - Unauthenticated IP Header Spoofing

The OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments No CAPTCHA plugin for WordPress is vulnerable to IP Header Spoofing in all versions up to, and including, 1.2.53. This is due to the plugin trusting client-controlled forwarded headers such as CF-Connecting-IP, X-Forwarded-For,...

CVE-2025-12094 OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) <= 1.2.53 - Unauthenticated IP Header Spoofing

The OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments No CAPTCHA plugin for WordPress is vulnerable to IP Header Spoofing in all versions up to, and including, 1.2.53. This is due to the plugin trusting client-controlled forwarded headers such as CF-Connecting-IP, X-Forwarded-For,...

EUVD-2025-37313

The OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments No CAPTCHA plugin for WordPress is vulnerable to IP Header Spoofing in all versions up to, and including, 1.2.53. This is due to the plugin trusting client-controlled forwarded headers such as CF-Connecting-IP, X-Forwarded-For,...