EUVD-2025-67204

Malicious code in richcicadaz3n npm...

Malicious code in rich_silverfish_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76eabdb9158dbc2142e7c4e5619697652cb135b3c64f1e4ad1450ff93add8479 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-52273

Malicious code in rich-silver-piranha npm...

EUVD-2025-52274

Malicious code in rich-chocolate-dog npm...

Malicious code in rich-chocolate-dog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d72c0b5c208569b8f9bc3f3077896bc67b00c12e5abe0f2007f67bd99cb3861 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-70375 Malicious code in rich-chocolate-dog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d72c0b5c208569b8f9bc3f3077896bc67b00c12e5abe0f2007f67bd99cb3861 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rich_rattlesnake_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc9d3874f4c6a93b0dd355443a7155a24271cc8e882b7d441695c9c67a330df6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-49464

Malicious code in richcuckooz3n npm...

EUVD-2025-49463

Malicious code in richdormousez3n npm...

EUVD-2025-45559

Malicious code in richpigeonz3n npm...

Exploit for CVE-2025-64495

CVE-2025-64495-POC Open WebUI vulnerable to Stored DOM XSS via...

CVE-2025-64495

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. In versions 0.6.34 and below, the functionality that inserts custom prompts into the chat window is vulnerable to DOM XSS when 'Insert Prompt as Rich Text' is enabled, since the prompt body is...

CVE-2025-64495

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. In versions 0.6.34 and below, the functionality that inserts custom prompts into the chat window is vulnerable to DOM XSS when 'Insert Prompt as Rich Text' is enabled, since the prompt body is...

CVE-2025-64495

Open WebUI (self-hosted offline AI platform) is affected by a Stored DOM XSS in RichTextInput when the “Insert Prompt as Rich Text” option is enabled. In versions 0.6.34 and earlier, the prompt body is parsed with marked.parse and then assigned to a temporary div’s innerHTML without sanitisation,...

CVE-2025-64495 Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. In versions 0.6.34 and below, the functionality that inserts custom prompts into the chat window is vulnerable to DOM XSS when 'Insert Prompt as Rich Text' is enabled, since the prompt body is...

EUVD-2025-38257

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. In versions 0.6.34 and below, the functionality that inserts custom prompts into the chat window is vulnerable to DOM XSS when 'Insert Prompt as Rich Text' is enabled, since the prompt body is...

CVE-2025-64495 Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. In versions 0.6.34 and below, the functionality that inserts custom prompts into the chat window is vulnerable to DOM XSS when 'Insert Prompt as Rich Text' is enabled, since the prompt body is...

CVE-2025-64495 Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. In versions 0.6.34 and below, the functionality that inserts custom prompts into the chat window is vulnerable to DOM XSS when 'Insert Prompt as Rich Text' is enabled, since the prompt body is...

Malicious code in chromifypro (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4138883ad2e38b4a8a4353918126f4732db5f04107be0bddafc745ec97120b52 Packages silently decrypt content hidden in a dependency and load them as Python extension modules. In the first wave, those are copies of legitimate aiohttp a...

MAL-2025-191702 Malicious code in chromifypro (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4138883ad2e38b4a8a4353918126f4732db5f04107be0bddafc745ec97120b52 Packages silently decrypt content hidden in a dependency and load them as Python extension modules. In the first wave, those are copies of legitimate aiohttp a...