EulerOS Virtualization 2.12.1 : openssl (EulerOS-SA-2025-1550)

According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Issue summary: Use of the low-level GF2^m elliptic curve APIs with untrusted explicit values for the field polynomial can lead to...

Securing the Code: Building a Culture of Credential Protection in Dev Teams

Credential protection is key to preventing breaches. Secure APIs, rotate secrets and train devs to handle credentials safely…...

Malicious code in nayan-imgur-upload-apis (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83086119743263f9bdf6c297c723c4435596eb345ae1346780b6cb9c49e0e597 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3842 Malicious code in nayan-apis-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 29f6aa37009fdc9a41baec1f7003012ff794de3dc17eaae4aa1c50aadba83bd8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3843 Malicious code in nayan-imgur-upload-apis (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83086119743263f9bdf6c297c723c4435596eb345ae1346780b6cb9c49e0e597 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nayan-apis-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 29f6aa37009fdc9a41baec1f7003012ff794de3dc17eaae4aa1c50aadba83bd8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in nayan-imgur-upload-apis

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in nayan-apis-server

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in imran-photo360-apis (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 50eee3813bcaa9eb9f2b3a96b47f8822b60b91073e385c5d3161fce029d42287 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in imran-photo360-apis

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2025-47777

5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Versions prior to 0.11.1 are vulnerable to stored cross-site scripting in chatbot responses due to insufficient sanitization. This, in turn, can lead to Remote Code Execution RCE via unsafe...

PT-2025-21176 · Electron +1 · Electron +1

Name of the Vulnerable Software and Affected Versions: 5ire versions prior to 0.11.1 Description: The issue is related to stored cross-site scripting in chatbot responses due to insufficient sanitization, which can lead to Remote Code Execution RCE via unsafe Electron protocol handling and expose...

Browser Security Posture Analysis: a Client-Side Security Assessment Framework

Modern web browsers have effectively become the new operating system for business applications, yet their security posture is often under-scrutinized. This paper presents a novel, comprehensive Browser Security Posture Analysis Framework1, a browser-based client-side security assessment toolkit...

CVE-2025-37842

In the Linux kernel, the following vulnerability has been resolved: spi: fsl-qspi: use devm function instead of driver remove Driver use devm APIs to manage clk/irq/resources and register the spi controller, but the legacy remove function will be called first during device detach and trigger kern...

UBUNTU-CVE-2025-37842

In the Linux kernel, the following vulnerability has been resolved: spi: fsl-qspi: use devm function instead of driver remove Driver use devm APIs to manage clk/irq/resources and register the spi controller, but the legacy remove function will be called first during device detach and trigger kern...

CVE-2025-37842: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: spi: fsl-qspi: use devm function instead of driver remove Driver use devm APIs to manage clk/irq/resources and register the spi controller, but the legacy remove function will be called first during device detach and trigger kern...

RLSA-2025:1740 Important: postgresql:16 security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation CVE-2025-1094 For more details about the security issues, including the impact, a CVSS score,...

.NET 8.0 security update

An update is available for dotnet8.0. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list .NET is a managed-software framework. It implements a subset of the .NET...

RLSA-2025:1739 Important: postgresql:15 security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation CVE-2025-1094 For more details about the security issues, including the impact, a CVSS score,...

JRuby-OpenSSL has hostname verification disabled by default

Summary When verifying SSL certificates, jruby-openssl is not verifying that the hostname presented in the certificate matches the one we are trying to connect to, meaning a MITM could just present any valid cert for a completely different domain they own, and JRuby wouldn't complain. Details n/a...