EUVD-2025-55306

Malicious code in compact-maroon-rook npm...

EUVD-2025-55204

Malicious code in continued-chocolate-rook npm...

EUVD-2025-54952

Malicious code in delicate-blush-rook npm...

EUVD-2025-54495

Malicious code in exciting-pink-rook npm...

EUVD-2025-55625

Malicious code in bold-gray-rook npm...

EUVD-2025-55484

Malicious code in chemical-orange-rook npm...

EUVD-2025-52919

Malicious code in opposite-tomato-rook npm...

Malicious code in pretty-purple-rook (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0658d2bbbfb8072a07b27ed4fae6af16dedea792ccc7bc914b18d08c700ca728 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-68154 Malicious code in exciting-pink-rook (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a2c78cf2e1d46d7790981a1079c9aaad1a3de138326e1fb0707a8f534f0cc6f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-65283 Malicious code in shrill_rook_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74fbe8fe2f4ac19527052c30c5f30b27be8f5a2fab0dd5453652558f63247acf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-44283

Malicious code in yummyrookz3n npm...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: kubebuilder, kubernetes-csi-external-snapshotter, influx, beats-fips, kubernetes-dashboard-api, dgraph, nova, nri-kafka, pgpool2exporter, contour-fips, helm-docs, aws-flb-cloudwatch-fips, kubernetes-dns-node-cache-fips, gitea, buf, cri-tools, kratos,...

CVE-2024-51744 affecting package rook for versions less than 1.6.2-26

CVE-2024-51744 affecting package rook for versions less than 1.6.2-26. A patched version of the package is available...

CVE-2025-27144 affecting package rook for versions less than 1.6.2-25

CVE-2025-27144 affecting package rook for versions less than 1.6.2-25. A patched version of the package is available...

CVE-2025-30204 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-managedidentity, zarf, crossplane, pulumi-kubernetes-operator, cosign, terraform, boring-registry, restic, flux-notification-controller, k3s, aactl, kube-metrics-adapter, opencost, secrets-store-csi-driver-provider-azure, sftpgo-plugin-pubsu...

AZL-77535 CVE-2025-30204 affecting package rook 1.6.2-27

golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious request whose...

CVE-2022-3162 affecting package rook for versions less than 1.6.2-24

CVE-2022-3162 affecting package rook for versions less than 1.6.2-24. A patched version of the package is available...

CVE-2024-28180 affecting package rook for versions less than 1.6.2-23

CVE-2024-28180 affecting package rook for versions less than 1.6.2-23. A patched version of the package is available...

CVE-2024-6104 affecting package rook for versions less than 1.6.2-21

CVE-2024-6104 affecting package rook for versions less than 1.6.2-21. A patched version of the package is available...

AZL-42922 CVE-2024-6104 affecting package rook for versions less than 1.6.2-21

go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7...