Malicious code in maman-ruwet47-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e493adc577402181413a0ddd564e5c073bf52706e45c84225c1524638b303eac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in maman-ongol-ongol19-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0bcf86a212d086df859c6a2871433322bcefcd17547bf27409c127fdf8631c9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-53586 Malicious code in ocha-esdoger69-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d8e6d242e40d12f8905e0b9dd1849ccd1caa9cb4388b615d384e041e1c323d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-53548 Malicious code in nurul-lontong95-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b39984e65f3d257ba34cc81f79a07b7c54de3d730c31e6ed51ea19986fbf7f1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-52378 Malicious code in tania-kue42-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 887b1d469f90ed779f56e9911db5752904a07e644da7bdf05946d01836f30a3a The package tania-kue42-breki was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...

Malicious code in andi-telur75-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d408bbda31e701242e81908eff0db91759ce5a4d1ccd185344d6e762c399994 The package andi-telur75-ruro was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...

Malicious code in udin-lontong47-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ce0856581fc21c748ac7d25d0a6f25cf8f469f3e2fbda9a5e73460492436ce0 The package udin-lontong47-breki was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flood...

MAL-2025-52689 Malicious code in wati-teh84-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9cf67d7fe693dae9df6160fe5e6170d90995c6e5991d82190db81ea6dfd123d The package wati-teh84-breki was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded n...

CVE-2025-64177

ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, there is a stored Cross-Site Scripting XSS vulnerability in the dashboard, which can exploited when a user clicks on a malicious bookmark, made vulnerable by the lack of scheme...

PT-2025-45385

Name of the Vulnerable Software and Affected Versions ThinkDashboard versions prior to 0.6.8 Description ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. A stored Cross-Site Scripting XSS issue exists in the dashboard for versions 0.6.7 and below due to a...

Path Traversal

esm.sh is vulnerable to Path Traversal. The vulnerability is due to improper sanitization of user-supplied URL components allowing path-traversal and file-scheme requests by which an attacker can craft specially-formed requests that cause the server to read and return arbitrary local files or oth...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: A memory leak occurs when free is called on olddamonsysfsschemefilter-memcgpath during writing. The memcgpathstore function assigns a newly allocated memory buffer to filter-memcgpath, without deallocating...

OESA-2025-2545 qt5-qtbase security update

Qt is a software toolkit for developing applications. Security Fixes: An issue was found in the private API function qDecodeDataUrl in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code. If the function was called with malformed data, for example, an URL that...

Security Bulletin: IBM QRadar Hub for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM QRadar Hub for IBM QRadar SIEM has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2025-58754 DESCRIPTION: Axios is a promise based HTTP clien...

A Comparative Study of Hybrid Post-Quantum Cryptographic X.509 Certificate Schemes

As quantum computing hardware continues to advance, the integration of such technology with quantum algorithms is anticipated to enable the decryption of ciphertexts produced by RSA and Elliptic Curve Cryptography ECC within polynomial time. In response to this emerging threat, the U.S. National...

CVE-2025-12080

On Wear OS devices, when Google Messages is configured as the default SMS/MMS/RCS application, the handling of ACTIONSENDTO intents utilizing the sms:, smsto:, mms:, and mmsto: Uniform Resource Identifier URI schemes is incorrectly implemented. Due to this misconfiguration, an attacker capable of...

PT-2025-43907

Name of the Vulnerable Software and Affected Versions Google Messages for Wear OS affected versions not specified Description A flaw exists in Google Messages for Wear OS where the handling of ACTION SENDTO intents using sms:, smsto:, mms:, and mmsto: Uniform Resource Identifier URI schemes is...

CVE-2025-62716 Plane Vulnerable to Cross-Site Scripting via Open Redirect in ?next_path Parameter

Plane is open-source project management software. Prior to version 1.1.0, an open redirect vulnerability in the ?nextpath query parameter allows attackers to supply arbitrary schemes e.g., javascript: that are passed directly to router.push. This results in a cross-site scripting XSS vulnerabilit...

Exploit for Server-Side Request Forgery in Apache Solr

CVE-2021-27905 | Sr No | Title...

CVE-2025-61536

FelixRiddle dev-jobs-handlebars 1.0 uses absolute password-reset magic links using the untrusted req.headers.host header and forces the http:// scheme. An attacker who can control the Host header or exploit a misconfigured proxy/load-balancer that forwards the header unchanged can cause reset lin...