CVE-2025-32900

In the KDE Connect information-exchange protocol before 2025-04-18, a packet can be crafted to temporarily change the displayed information about a device, because broadcast UDP is used. This affects KDE Connect before 1.33.0 on Android, KDE Connect before 25.04 on desktop, KDE Connect before 0.5...

CVE-2025-66548

The Nextcloud Deck app allows spoofing file extensions by using RTLO characters, causing a mismatch between the displayed and actual extension. Affected versions are prior to 1.12.7, 1.14.4, and 1.15.1; fixes are in 1.12.7, 1.14.4, and 1.15.1. Exploitation details are not provided in the supplied...

CVE-2025-66548 Nextcloud Deck app allows to spoof file extensions by using RTLO characters

Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.12.7, 1.14.4, and 1.15.1, file extension can be spoofed by using RTLO characters, tricking users into download files with a different extension th...

ROS-20251202-04

A vulnerability in the V8 JavaScript script handler of Google Chrome browser is related to reading outside the boundaries of the buffer. Exploitation of the vulnerability could allow an attacker acting remotely to impact the availability of protected information Vulnerability in the WebApp Instal...

Gladinet Triofox Improper Access Control (CVE-2025-12480)

The Gladinet Triofox prior to version 16.7.10368.56560. It is, therefore, are vulnerable to an Improper Access Control flaw. This vulnerability in Gladinet’s Triofox versions before 16.7.10368.56560 that lets unauthenticated attackers bypass authentication via a host-header spoof to...

Google Chrome < 4.8.271.17 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 4.8.271.17. It is, therefore, affected by multiple vulnerabilities as referenced in the 201601stable-channel-update20 advisory. - Multiple unspecified vulnerabilities in Google Chrome before 48.0.2564.82 allow attackers...

CVE-2025-13132 Dia: Increased Spoof Risk; Missing full screen toast

This vulnerability allowed a site to enter fullscreen, after a user click, without a full-screen notification toast appearing. Without this notification, users could potentially be misled about what site they were on if a malicious site renders a fake UI like a fake address bar...

CVE-2025-13132

CVE-2025-13132 affects the "dia" browser (Red Hat/Dia references) where a flaw allows entering fullscreen after a user click without showing the fullscreen notification toast. This could let a malicious site spoof the UI (e.g., fake address bar). Root cause: lack of fullscreen notification. Impac...

CVE-2025-51663

A vulnerability found in IPRateLimit implementation of FileCodeBox up to 2.2 allows remote attackers to bypass ip-based rate limit protection and failed attempt restrictions by faking X-Real-IP and X-Forwarded-For HTTP headers. This can enable attackers to perform DoS attacks or brute force share...

MAL-2025-182337 Malicious code in imodiov-kofi-cuidcavmnodag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 046f46f4fd918fd34a80115ededcbe7cbf40534e63a2a30dcd960908c779fabd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-175448 Malicious code in kapvino-sovni-fffsgfi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cd36e405b2d5b2a67207f357e9190bc75476062b95f7404f6b5cab8eae95d75 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-152798 Malicious code in arif-poke85 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0237109a06378a93a0d1c36129bc7a4449a7ca66e7972acd3abbbc913a9d187b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-164674 Malicious code in rino-poke3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 476444cdd5a63ec92769bd6ba2eefd9070ee1c7728174e1f0c2e1d83af63420c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in aquarius-webdriver-mocha-hyperion-cross-env (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68132720276fc1b8b24564e55a9b95066777fe576c7d605049235c96d36911c6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147528 Malicious code in rollup-plugin-yonder-draco-fork (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 882dd9b292283f0e6f159f85b76503f46a224aac7d185a399da12e6e783d5865 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146751 Malicious code in proxima-xerxes-await-parcel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5410adaf1035021a86a15b259d7ce60dc0365d4b361a661abd6d2fcce409b986 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in siska-mangut96-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15d14da2c69bda8f7e82ed54ab155994056f0f3f70b7329379e04ab3497381e3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-128807 Malicious code in nana-bubursumsum32-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 418f6ed5a0c2407b87a503e1c4bf46df84b468cd881c41fe88afeb3b6ed9df91 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hendra-kupang56-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b57c45312608fd4238e05cb598eeaadd53cffb3fb74b904112401e2a041c5f7b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-115422 Malicious code in light_dingo_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b58851fa3a782692e0bce8413ad4a754ef457c15e7608e891950f7008ca21859 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...