Malicious code in inal-poke2 (npm)

Source: amazon-inspector 363f0383f0d172207ce996fef7a51de9a3d52d253c3930746e845a8b1d64bc6d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in ida-mangut2-breki (npm)

Source: amazon-inspector 5cd003b2847409246edb7cb8a8dd19f05f0cafef167cb02f6673ca10257248d1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in ida-kue95-breki (npm)

Source: amazon-inspector 855f79760ade1b35c36ab5168c05b0f0df279c9be05f9e7b1f85fdb909f0259c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in high_smelt_z3n (npm)

Source: amazon-inspector 3e19a2ef2b4517bc4740697e327128915b741390c100be9da25b0604034d7647 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in hendra-nasiuduk89-breki (npm)

Source: amazon-inspector a6426eaed4c8972dd6b1c95ad7274e7beffb50dfeaec7559796d5e7deb234ba1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in hariyono-poke17 (npm)

Source: amazon-inspector c4b30697c67d6064c1f2f994ff9bfcb044b69ed347a905e9e2ad56260373883d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in hanafi-rangi46-miaww (npm)

Source: amazon-inspector f9e8b40d9cfe0346c9fb876037762a5dc9465dfaff99ac99630291402e6e3640 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in hadi-lutis18-riris (npm)

Source: amazon-inspector 43ecfe7b3afd481a6d282bd0a13fa799171aafc509dec512d1fb544e496c3037 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in guras-nitroacer-teajaw (npm)

Source: amazon-inspector 000ab5e1dc60fc8d5ecc2e747a2c89ed86f2b066c74e2f83ecd1b85c674725fa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in gita-toge4-miaww (npm)

Source: amazon-inspector 46ac5f11ad8c87be2d80085ea310f598b6eced5de402ece9949c025df022e90c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in gita-teh95-breki (npm)

Source: amazon-inspector 9b1f8bcbb68d6f22e4d404d11f1f46da53c1c1e4f1be524794d79926ce51bd59 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

CVE-Project

CVE-Project CISA KEV vulnerability PoC collection — 393 CVEs...

CVE-2025-15695

The Translate WordPress with GTranslate WordPress plugin before 3.0.10 does not validate one of its settings before the bundled front-end scripts build markup from it, allowing users with a role as high as administrator to store JavaScript that runs in the session of any visitor to the site...

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering

A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting XSS attacks, where...

CVE-2025-15695 GTranslate < 3.0.10 - Admin+ Stored XSS

The Translate WordPress with GTranslate WordPress plugin before 3.0.10 does not validate one of its settings before the bundled front-end scripts build markup from it, allowing users with a role as high as administrator to store JavaScript that runs in the session of any visitor to the site...

CVE-2025-15695 GTranslate < 3.0.10 - Admin+ Stored XSS

The Translate WordPress with GTranslate WordPress plugin before 3.0.10 does not validate one of its settings before the bundled front-end scripts build markup from it, allowing users with a role as high as administrator to store JavaScript that runs in the session of any visitor to the site...

Improper Restriction of Rendered UI Layers or Frames

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Improper Restriction of Rendered UI Layers or Frames in the PortPreview process. An attacker can gain access to session tokens and take over user accounts by serving malicious scripts on a terminal server por...

Malicious code in fadhil-mendoan28-riris (npm)

Source: amazon-inspector 6a05a3f2dab3d437ac4e32529550f928f07dffdbafb3c2dd2d8a0dbb80f94640 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in erick-tomat56-pore (npm)

Source: amazon-inspector da9af9994ec721c8c526b1fd9af9734df2dbfbb3fb1620e3e5c45d439804c004 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in equivalent_dove_z3n (npm)

Source: amazon-inspector e1573034cb16288116a4d9db1992c47f005cf642fc36aa22b2e52c04769993ac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...