Malicious code in nokire-genji3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fec4a3af141f6946205e9a08f9474387a37522d799bc0b6772960a207d577d55 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in alvino-3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a13d55c4c8740d37d2a3e6a453631beab1dfc603e345f64de5e6784a0530c047 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in abeh-poke3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53f499d70aa82f6a5f68bcab9e5ccb177c79f51307449f0200508218d7f0b459 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-164299 Malicious code in pitra-3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70642fb94c2d751c372e12f5b055135170ce017bf72cc3554829b73a69abe3da This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-152018 Malicious code in air-poke3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cb8b149d005c44ba6b8e380a212562249d0004f02a0c5421bb8ec89a91ce739 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bitha-73 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ec4202f2a7775cbfa561cdf1999eb84f547e33c7ba5a8a5cd5ca114429e4477 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pitra-3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70642fb94c2d751c372e12f5b055135170ce017bf72cc3554829b73a69abe3da This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kentung-63 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c44d176407d4da9e7089ffc57beac03e520f4b3605991078ccec31250d5b2ee This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cinta-63 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 972d7a6c0351c2383e0a6b64bcf1428f41cf5e45263c83c69e8ca546921420ff This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rita-43 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42a69757c95771d2544f7276b13464e1c46b3d88183ff2bfcead6cfa68b6958d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-165248 Malicious code in ruji-23 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 920d3854dd467640b5abc8cfcfba271f2094af379e35d5d2ba4ae98a24fdcfcb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-162341 Malicious code in nokire-arhani3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5cd06ae0e73bf4d42c8f804889379cf4c5422e1718d100fb0d8f604c4f1137a7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

kernel: ALSA: usb-audio: Validate UAC3 cluster segment descriptors

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 cluster segment descriptors UAC3 class segment descriptors need to be verified whether their sizes match with the declared lengths and whether they fit with the allocated buffer sizes, too. Otherwis...

EUVD-2025-124939

In the Linux kernel, the following vulnerability has been resolved: nvdimm: ndtest: Return -ENOMEM if devmkcalloc fails in ndtestprobe devmkcalloc may fail. ndtestprobe allocates three DMA address arrays dcrdma, labeldma, dimmdma and later unconditionally uses them in ndtestnvdimminit, which can...

CVE-2025-40144

CVE-2025-40144 relates to the Linux kernel nvdimm subsystem: ndtest may NULL-dereference under low memory if devm_kcalloc() allocations fail. The fix adds checks for three DMA address arrays (dcr_dma, label_dma, dimm_dma) and returns -ENOMEM on allocation failure, routing to a common error path. ...

Microsoft Fixes 63 Security Flaws, Including a Windows Kernel Zero-Day Under Active Attack

Microsoft on Tuesday released patches for 63 new security vulnerabilities identified in its software, including one that has come under active exploitation in the wild. Of the 63 flaws, four are rated Critical and 59 are rated Important in severity. Twenty-nine of these vulnerabilities are relate...

Moderate: Red Hat Security Advisory: RHOAI 3.0 - Red Hat OpenShift AI

Updated images are now available for Red Hat OpenShift AI. Release of RHOAI 3.0 provides these changes:...

CVE-2025-12732

CVE-2025-12732 impacts the WordPress plugin “WP Import – Ultimate CSV XML Importer for WordPress” (versions

CVE-2025-12732 WP Import – Ultimate CSV XML Importer for WordPress <= 7.33 - Missing Authorization to Authenticated (Author+) Sensitive Information Exposure

The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of sensitive information due to a missing authorization check on the showsetting function in all versions up to, and including, 7.33. This makes it possible for authenticated attacker...

Security update for the Linux Kernel (Live Patch 60 for SUSE Linux Enterprise 15 SP3)

This update for the SUSE Linux Enterprise kernel 5.3.18-150300.59.215 fixes various security issues The following security issues were fixed: CVE-2022-50248: wifi: iwlwifi: mvm: fix double free on tx path bsc1249841. CVE-2022-50252: igb: Do not free qvector unless new one was allocated bsc1249847...