DoS (Denial of Service) Third-Party Dependency in Bitbucket Data Center and Server - CVE-2025-55163

This High severity vulnerability known as CVE-2025-55163 was introduced in 3.3.1, 3.5.0, 3.6.0, 8.18.0, 9.1.0, 9.0.1, 9.2.0, 9.4.0, 9.4.1, 9.4.2, 9.4.3, 9.4.4, 9.4.5, 10.0.0, 9.4.6, 9.4.7, 9.4.8, 9.4.9, 9.4.11 of Bitbucket Data Center and Server. This vulnerability with a CVSS Score of 8.2 and a...

CVE-2025-64747 Directus Vulnerable to Stored Cross-site Scripting

Directus is a real-time API and App dashboard for managing SQL database content. A stored cross-site scripting XSS vulnerability exists in versions prior to 11.13.0 that allows users with upload files and edit item permissions to inject malicious JavaScript through the Block Editor interface...

CVE-2025-60699

creationtimestamp| type| source ---|---|--- 2025-11-13 20:16:00+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115544225218632911 2025-11-13 21:11:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5k3cqaorj2w...

PT-2025-46911

Name of the Vulnerable Software and Affected Versions Directus versions prior to 11.13.0 Description Directus does not properly remove field-level permissions when a field is deleted. When a field is removed from a collection, its reference in the permissions table is not cleared. This creates a...

Debian: Security Advisory (DSA-6055-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Directus 安全漏洞

Directus is a real-time Api and application dashboard open-sourced by Directus. It is used to manage Sql database content. A security vulnerability exists in Directus versions prior to 11.13.0 that stems from a REST API error message discrepancy that could lead to the disclosure of unauthorized...

CVE-2025-40187

In the Linux kernel, the following vulnerability has been resolved: net/sctp: fix a null dereference in sctpdisposition sctpsfdo51Dce If newasoc-peer.adaptationind=0 and sctpulpeventmakeauthkey=0 and sctpulpeventmakeauthkey returns 0, then the variable aiev remains zero and the zero will be...

CVE-2025-63396

An issue was discovered in PyTorch v2.5 and v2.7.1. Omission of profiler.stop can cause torch.profiler.profile PythonTracer to crash or hang during finalization, leading to a Denial of Service DoS...

Malicious code in kiki-poke13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fbb537cd353d1d34b4cc1a84720164bc8d511fc605eab0f8a6c31830fb3bf95 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in koko-poke13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10f99ad31ed4279b2b152f3f5307d8961ede4dbcb570c028125297fd41117916 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in alvino-13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f8d45324e3481e0aa4d53a74f803da1a4064a51a2269f6a21ab8867b1ca23da This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-139930

Malicious code in nokire-kushina13 npm...

EUVD-2025-148074

Malicious code in tealoveness13 npm...

Malicious code in manda-13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81d905a7eaf02b8b226e5d507f98d3ee264dc941ad555543e5ba1f64fbd5a674 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tealoveness13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07c84125394058cab54c1d13f7e2417d64237ae04db091d19989d57f2829ddec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-168589 Malicious code in tealove-okta13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05d213c7e123524e5920b2377b0425c71246ae1bae72fb628013e1dccb978ade This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-158170 Malicious code in lintang-tea13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6552c3bfbcadb806ce9f7f3487c959c7804d5ddd923138964f18db6225b201c2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-152719 Malicious code in arif-poke13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6468771d3c80ee6b1203965a96a69e021701b0e611390fe962c4fb12c9d3948 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-155567 Malicious code in hafiz-13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68cdaeb28b1a2df9e87dfcfb5abdc8ecc681a6fe08bdba529c14a5e06fc3fcc2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

BIT-OAUTH2-PROXY-2025-64484 OAuth2-Proxy vulnerable to header smuggling via underscore, leading to potential privilege escalation

OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups. In versions prior to 7.13.0, all deployments of OAuth2 Proxy in front of applications that normalize underscores to dashe...