CVE-2025-40222 tty: serial: sh-sci: fix RSCI FIFO overrun handling

In the Linux kernel, the following vulnerability has been resolved: tty: serial: sh-sci: fix RSCI FIFO overrun handling The receive error handling code is shared between RSCI and all other SCIF port types, but the RSCI overrunreg is specified as a memory offset, while for other SCIF types it is a...

GO-2025-4138 esm.sh CDN service has arbitrary file write via tarslip in github.com/esm-dev/esm.sh

esm.sh CDN service has arbitrary file write via tarslip in github.com/esm-dev/esm.sh...

CVE-2025-65026

esm.sh is a nobuild content delivery networkCDN for modern web development. Prior to version 136, The esm.sh CDN service contains a Template Literal Injection vulnerability CWE-94 in its CSS-to-JavaScript module conversion feature. When a CSS file is requested with the ?module query parameter,...

CVE-2025-65025 esm.sh CDN service has arbitrary file write via tarslip

esm.sh is a nobuild content delivery networkCDN for modern web development. Prior to version 136, the esm.sh CDN service is vulnerable to path traversal during NPM package tarball extraction. An attacker can craft a malicious NPM package containing specially crafted file paths e.g.,...

PT-2025-47463

Name of the Vulnerable Software and Affected Versions Sound4 FIRST affected versions not specified Description The Sound4 FIRST web-based management interface is susceptible to Remote Code Execution RCE through a maliciously crafted firmware update package. The system’s update process does not...

Malicious code in buta-faag-saifa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 24109c352f9de8521185b22cf2cb11fadf66e54415597bb06c290d1418d402d0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in billa-76 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbefa41b621ba38105dd755eae78a5952c2b96ba59b10f6e8b5ab92c2a797c2a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nokire-zenitsu38 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34be1fc43118b917513fd3394428086750d3e293c63ee403bbb5fedcd0450b76 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-118429 Malicious code in zaki-kepok25-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22f31f898c73f4fa0458b8257fcf7341d1543d2957f1f83c9e94a0e19b737ce9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-114376 Malicious code in grateful_gazelle_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb3c1c3925a8c6d7f355b6149fad351b51ee3444bd7514a00caeed4616201c28 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-115377 Malicious code in laila-mangut96-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1717f9eed3745d0111a50ed302d044881f4bbdc13322b70bc7d66695e6b35413 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-106690 Malicious code in oktafian-nasicampur59-remi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4839fdecb18fc4cbafcf193b4961459fb8cf790363bbc1c09a73122e56cb813 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-82744 Malicious code in zaki-oncom87-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89153ace27f2b896e61005de542a220022cf816011f7aa6cb12a9a129dbc165b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in muddy-salmon-cuckoo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de26ff577cf8f93895f8b3017e31b06399d6a83a642f16dd9420952661bb8f6b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in citra-takokak21-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1362e2712cc20665c5aa21c830173a839e5907feac543971c49221f91e59e812 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-63296

KERUI K259 5MP Wi-Fi / Tuya Smart Security Camera firmware v33.53.87 contains a code execution vulnerability in its boot/update logic: during startup /usr/sbin/anykaservice.sh scans mounted TF/SD cards and, if /mnt/update.nor.sh is present, copies it to /tmp/net.sh and executes it as root...

WordPress SH Contextual Help plugin <= 3.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by johska in WordPress Plugin SH Contextual Help versions = 3.2.1...

PT-2025-44956

The SH Contextual Help plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing or incorrect nonce validation in the sh contextual help dashboard widget function. This makes it possible for unauthenticated attackers to...

Path Traversal

esm.sh is vulnerable to Path Traversal. The vulnerability is due to improper validation of the X-Zone-Id HTTP header when constructing filesystem paths, which allows an attacker to use ../ sequences to write files outside the intended storage directory and access arbitrary locations on the system...

CVE-2025-34515 Ilevia EVE X1 Server 4.7.18.0.eden Root Privilege Escalation

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an execution with unnecessary privileges vulnerability in syncproject.sh that allows an attacker to escalate privileges to root. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to...