EUVD-2025-122833

Malicious code in readable-pino-pretty-style-loader-jekyll npm...

EUVD-2025-122840

Malicious code in readable-heka-chakra-ui-lacerta npm...

Malicious code in meissa-chakra-ui-mensa-readable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c41dcb2039948b5b1d3b95f09151efa9edd50c427aa1fcc052a6de060068f44 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-114678

Malicious code in cz-conventional-changelog-readable-version-cz-conventional-changelog npm...

EUVD-2025-112443

Malicious code in install-build-readable-gacrux npm...

MAL-2025-140520 Malicious code in celeste-remark-readable-rocket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 724e457d8f4a5cdd399e63be6f869bbfb4f00b98106d11925fdc6580ac65bf57 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145329 Malicious code in nconf-readable-wasat-ariel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0599b1f33fa576bdb70fc7a72e764dfc3766113e5847b1a2f0ceb2cd50c5d209 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147083 Malicious code in readable-jwt-fornax-ultra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74332985997efc05d337b4e9ac85601488e33e0cf443517dc025b4354e7dee92 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146119 Malicious code in perseus-tailwindcss-sagitta-readable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe718078873d5a61ddb4eb1d9bf6a74722c114987d641c9b5a9f4a5a7d467c0b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147093 Malicious code in readable-thuban-init-pyxis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8733cfa1a946d8622545f8700875be755e52be1e80ab8df4d0350d62cb65bfb6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-114606

Malicious code in deimos-readable-winston-yonder npm...

CVE-2024-32010

A vulnerability has been identified in Spectrum Power 4 All versions V4.70 SP12 Update 2. The affected application is vulnerable to extraction of database credentials via a world-readable credential file. This allows an attacker to connect to the database as privileged application user and to run...

CVE-2024-32010

A vulnerability has been identified in Spectrum Power 4 All versions V4.70 SP12 Update 2. The affected application is vulnerable to extraction of database credentials via a world-readable credential file. This allows an attacker to connect to the database as privileged application user and to run...

CVE-2024-32010

A vulnerability has been identified in Spectrum Power 4 All versions V4.70 SP12 Update 2. The affected application is vulnerable to extraction of database credentials via a world-readable credential file. This allows an attacker to connect to the database as privileged application user and to run...

PT-2025-46535

Name of the Vulnerable Software and Affected Versions Spectrum Power versions prior to 4.70 SP12 Update 2 Description The application is susceptible to the exposure of database credentials through a world-readable credential file. Successful exploitation allows an attacker to connect to the...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: The TOCTOU issue in skisreadable has been fixed. sk-skprot-sockisreadable is a valid function pointer when sk resides in a sockmap. After the last skpsockput call which usually occurs when a socket is removed from the sockma...

curl: curl’s persistence files inherit world-readable/writable perms from umask, leaking and tampering with cookies/HSTS/Alt-Svc caches

Executive Summary Curlfopen clones the permissions of any pre-existing persistence file when creating its temporary file. When the persistence file does not exist, it first creates one with the process umask typically 022, i.e., 0644. That mode is then copied to the temp file via 0600 | sb.stmode...

CVE-2025-54808

Oxford Nanopore Technologies' MinKNOW software at or prior to version 24.11 stores authentication tokens in a file located in the system's temporary directory /tmp on the host machine. This directory is typically world-readable, allowing any local user or application to access the token. If the...

CVE-2025-54808 Oxford Nanopore Technologies MinKNOW Insufficiently Protected Credentials

Oxford Nanopore Technologies' MinKNOW software at or prior to version 24.11 stores authentication tokens in a file located in the system's temporary directory /tmp on the host machine. This directory is typically world-readable, allowing any local user or application to access the token. If the...

PT-2025-43541

Name of the Vulnerable Software and Affected Versions Oxford Nanopore Technologies MinKNOW versions prior to 24.11 Description The MinKNOW software stores authentication tokens in a world-readable file within the system's temporary directory /tmp on the host machine. If a token is compromised, an...