MAL-2025-192939 Malicious code in magic-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6dea39f25cc72cc9ab080d6f35ef68c9a061a8df5fe184194798109dad36faa5 The package magic-poc was found to contain malicious code. Source: ghsa-malware 89ec0cb0d10ed48f38fd79d080a40f46510b46211da23e64a2c72d9b053cb73b Any...

Malicious code in ing-feat-pis-single-payments (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94bc97753b6e7a9fa1430482f3266bf40e985ab97ef48bbd35a8d7fd8f404ca6 The package ing-feat-pis-single-payments was found to contain malicious code. Source: ossf-package-analysis...

CERTFR-2025-ACT-056

creationtimestamp| type| source ---|---|--- 2025-12-22 13:56:42+00:00| seen| https://bsky.app/profile/cert-fr.bsky.social/post/3malf7z6yfx2c 2025-12-22 13:56:43+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/115763563781757176 2025-12-28 01:17:54+00:00| seen|...

Malicious code in @nosinovacao/nosid-mfe-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f49ca2c72725bef26372372dfae65145d32d2d69179865156de7a930c88853d The package @nosinovacao/nosid-mfe-common was found to contain malicious code. Source: ghsa-malware...

Malicious code in shakti20261 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a217c3c91ff80edbc760c82358d7d22c5819f0110ccf221e4d3639eb22e08ac7 The package shakti20261 was found to contain malicious code. Source: ghsa-malware e75357912e9e470657d646a2fd23a82c2f23cd2a6d0a987fb5b880eb8fa4c731 An...

CISA: Suspicious Unmanned Aircraft System Activity Guidance

Suspicious Unmanned Aircraft System Activity Guidance for Critical Infrastructure Owners and Operators is intended for critical infrastructure stakeholders who are concerned with unmanned aircraft system UAS activity near or around their facilities...

CVE-2025-14817

The component com.transsion.tranfacmode.entrance.main.MainActivity in com.transsion.tranfacmode has no permission control and can be accessed by third-party apps which can construct intents to directly open adb debugging functionality without user interaction...

Black Friday 2025 in Review: What Retailers Need to Know About This Year’s Holiday Shopping Season

Holiday shopping season is in full swing, and Black Friday 2025 continued to demonstrate that consumer demand and attacker activity shows no signs of slowing. According to Adobe Analytics, U.S. consumers spent $11.8 billion online on Black Friday, setting a new record and highlighting sustained...

CVE-2025-14817

The component com.transsion.tranfacmode.entrance.main.MainActivity in com.transsion.tranfacmode has no permission control and can be accessed by third-party apps which can construct intents to directly open adb debugging functionality without user interaction...

CVE-2025-14702

A flaw has been found in Smartbit CommV Smartschool App up to 10.4.4. Impacted is an unknown function of the component be.smartschool.mobile.SplashActivity. Executing manipulation can lead to path traversal. The attack requires local access. The exploit has been published and may be used. The...

CERTFR-2025-ACT-055

creationtimestamp| type| source ---|---|--- 2025-12-15 13:42:31+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/115723871774526633...

CVE-2025-14702 Smartbit CommV Smartschool App be.smartschool.mobile.SplashActivity path traversal

A flaw has been found in Smartbit CommV Smartschool App up to 10.4.4. Impacted is an unknown function of the component be.smartschool.mobile.SplashActivity. Executing manipulation can lead to path traversal. The attack requires local access. The exploit has been published and may be used. The...

EUVD-2025-203328

A flaw has been found in Smartbit CommV Smartschool App up to 10.4.4. Impacted is an unknown function of the component be.smartschool.mobile.SplashActivity. Executing manipulation can lead to path traversal. The attack requires local access. The exploit has been published and may be used. The...

CVE-2025-14702 Smartbit CommV Smartschool App be.smartschool.mobile.SplashActivity path traversal

A flaw has been found in Smartbit CommV Smartschool App up to 10.4.4. Impacted is an unknown function of the component be.smartschool.mobile.SplashActivity. Executing manipulation can lead to path traversal. The attack requires local access. The exploit has been published and may be used. The...

Smartbit CommV Smartschool App 路径遍历漏洞

Smartbit CommV Smartschool App is a school management software from the Belgian company Smartbit CommV. A path traversal vulnerability exists in Smartbit CommV Smartschool App version 10.4.4 and earlier, which stems from a path traversal issue in the component be.smartschool.mobile.SplashActivity...

PT-2025-51189

A flaw has been found in Smartbit CommV Smartschool App up to 10.4.4. Impacted is an unknown function of the component be.smartschool.mobile.SplashActivity. Executing manipulation can lead to path traversal. The attack requires local access. The exploit has been published and may be used. The...

Detecting Malicious Entra OAuth Apps with LLM-Based Permission Risk Scoring

This project presents a unified detection framework that constructs a complete corpus of Microsoft Graph permissions, generates consistent LLM-based risk scores, and integrates them into a real-time detection engine to identify malicious OAuth consent activity...

Improper Input Validation

mantisbt/mantisbt is vulnerable to improper input validation. The vulnerability is due to lack of server-side validation on note length, which allows an attacker to submit excessively long notes and corrupt the issue activity logs, thereby breaking the activity stream UI and preventing future...

CVE-2025-43516

A session management issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. A user with Voice Control enabled may be able to transcribe another user's activity...

CVE-2025-43516

A session management issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. A user with Voice Control enabled may be able to transcribe another user's activity...