JINX-0164 Targets Cryptocurrency Firms with Fake Recruiter Lures and macOS Malware

A new campaign orchestrated by a previously undocumented threat actor has targeted cryptocurrency organizations with an aim to facilitate digital asset theft using recruitment-themed social engineering and bespoke macOS malware. "These campaigns leveraged sophisticated social engineering...

CVE-2026-2920

creationtimestamp| type| source ---|---|--- 2026-03-06 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-26-164/ 2026-03-16 15:47:07+00:00| seen| https://ccb.belgium.be/advisories/warning-multiple-critical-vulnerabilities-gstreamer-patch-immediately 2026-03-18 05:20:09+00:00|...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-django (UTSA-2026-000164)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000164 advisory. An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could resu...

EUVD-2025-200884

Malicious code in elf-stats-joyous-mailbag-164 npm...

MAL-2025-192068 Malicious code in elf-stats-joyous-mailbag-164 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2516c2d6caba7d1bb2d0edcc4cf2903c6f3e8df39517bae257f5d2b433092a40 The package elf-stats-joyous-mailbag-164 was found to contain malicious code...

Malicious code in elf-stats-joyous-mailbag-164 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2516c2d6caba7d1bb2d0edcc4cf2903c6f3e8df39517bae257f5d2b433092a40 The package elf-stats-joyous-mailbag-164 was found to contain malicious code...

EUVD-2025-25491

Malicious code in bioql PyPI...

Malicious code in whiskey-164-project (npm)

The package whiskey-164-project was found to contain malicious code...

MAL-2025-39162 Malicious code in whiskey-164-project (npm)

The package whiskey-164-project was found to contain malicious code...

CVE-2020-21834

A null pointer deference issue exists in GNU LibreDWG 0.10 via getbmp ../../programs/dwgbmp.c:164...

Slackware Linux 15.0 / current mozilla-thunderbird Multiple Vulnerabilities (SSA:2024-164-01)

The version of mozilla-thunderbird installed on the remote host is prior to 115.11.1 / 127.0. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-164-01 advisory. New mozilla-thunderbird packages are available for Slackware 15.0 and -current to fix security issues...

Upgraded Q -> M from #164 [1674419095024]

Judge has assessed an item in Issue 164 as M risk. The relevant finding follows: LOW‑1 The Contract Should approve0 First Some tokens like USDT L199 do not work when changing the allowance from an existing non-zero allowance value. They must first be approved by zero and then the actual allowance...

CVE-2022-44213

ZKTeco Xiamen Information Technology ZKBio ECO ADMS =3.1-164 is vulnerable to Cross Site Scripting XSS...

ZKTeco ZKBio Time 跨站脚本漏洞

ZKTeco ZKBio Time is a powerful web-based time and attendance management software from ZKTeco, China. A security vulnerability exists in ZKTeco ZKBio Time prior to version 3.1-164, which originates from a vulnerability that allows users to embed malicious code in the Web UI...

Upgraded Q -> M from #164 [1668687728737]

Judge has assessed an item in Issue 164 as M risk. The relevant finding follows: 01 Lack of check if dust ether transfer is successful --- The text was updated successfully, but these errors were encountered: All reactions...

Amazon Linux 2022 : ImageMagick, ImageMagick-c++, ImageMagick-c++-devel (ALAS2022-2022-164)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-164 advisory. A divide-by-zero flaw was found in ImageMagick in gem.c. This flaw allows an attacker who submits a crafted file that is processed by ImageMagick to trigger undefined behavior through a divisio...

ip170.ip-164-132-72.eu Cross Site Scripting vulnerability OBB-2351629

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

azure-ad allows bypassing CSRF protection for any URL

An extension point in Jenkins allows selectively disabling cross-site request forgery CSRF protection for specific URLs. azure-ad implements this extension point for URLs used by a JavaScript component. In azure-ad 179.vf6841393099e and earlier this implementation is too permissive, allowing...

Streaming Numbers Jump for European Football Tournament Delivered by Akamai

The video streaming traffic that Akamai delivered for more than 30 rights-holding customers during the July 11 Italy-England football soccer final as part of the delayed-to-2021European soccer tournament peaked at 34.9 Tbps on the Akamai edge platform. The traffic peak during the final match was...

The vulnerability of the wlc_wpa_plumb_gtk driver for Broadcom Wi-Fi devices allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the wlcwpaplumbgtk driver for Broadcom Wi-Fi devices is related to buffer overflows in the “heap”. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code or cause a service failure by sending specially crafted Wi-Fi packets containing data...