EUVD-2025-51893

Malicious code in specific-gray-gibbon npm...

EUVD-2025-51892

Malicious code in specific-gray-meerkat npm...

EUVD-2025-51894

Malicious code in specific-fuchsia-scallop npm...

MAL-2025-70754 Malicious code in specific-bronze-guanaco (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00e8981ac8d6dfb6a2c43c9cb57d095b077f25272bdda9aab002af736f9f43e1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

PT-2025-46312

Name of the Vulnerable Software and Affected Versions affected versions not specified Description A flaw exists that allows the upload of files with a specific name to a temporary directory. This can lead to process crashes and reduced usability. Exploitation requires authentication with an...

CVE-2025-12729

Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-12729

Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-12444

Incorrect security UI in Fullscreen UI in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

CVE-2025-12447

Incorrect security UI in Omnibox in Google Chrome on Android prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

CVE-2025-12444

Incorrect security UI in Fullscreen UI in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

CVE-2025-12447

Incorrect security UI in Omnibox in Google Chrome on Android prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

CVE-2025-12434

A race condition in the Storage component of Google Chrome and Microsoft Edge on Windows allows a remote attacker to perform UI spoofing . By convincing a user to engage in specific UI gestures on a crafted HTML page, the attacker can exploit synchronization errors when using a shared resource. T...

CVE-2025-12434

Race in Storage in Google Chrome on Windows prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

EUVD-2025-45211

Malicious code in specificstarfishz3n npm...

QNAP Notification Center 跨站脚本漏洞

QNAP Notification Center is a system event alert and notification software from Taiwan, China-based QNAP Technology QNAP. A cross-site scripting vulnerability exists in QNAP Notification Center versions 2.1.0.3443, 1.9.2.3163, and 3.0.0.3466, which stems from susceptibility to cross-site scriptin...

CVE-2025-11208

Inappropriate implementation in Media in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-11208

Inappropriate implementation in Media in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

Incorrect Execution-Assigned Permissions

Overview Affected versions of this package are vulnerable to Incorrect Execution-Assigned Permissions when initialising host directories with 711 and 755 permissions instead of 700. An attacker can gain unauthorized access to sensitive data and potentially escalate privileges by accessing...

CVE-2025-64458

An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. NFKC normalization in Python is slow on Windows. As a consequence, django.http.HttpResponseRedirect, django.http.HttpResponsePermanentRedirect, and the shortcut django.shortcuts.redirect were subject to a...

Specification-Guided Vulnerability Detection with Large Language Models

Large language models LLMs have achieved remarkable progress in code understanding tasks. However, they demonstrate limited performance in vulnerability detection and struggle to distinguish vulnerable code from patched code. We argue that LLMs lack understanding of security specifications -- the...