INVT VT-Designer and HMITool

RISK EVALUATION Successful exploitation of these vulnerabilities could allow attackers to execute arbitrary code in the context of the current process. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:...

SIExVulTS: Sensitive Information Exposure Vulnerability Detection System Using Transformer Models and Static Analysis

Sensitive Information Exposure SIEx vulnerabilities CWE-200 remain a persistent and under-addressed threat across software systems, often leading to serious security breaches. Existing detection tools rarely target the diverse subcategories of CWE-200 or provide context-aware analysis of code-lev...

PT-2026-33168

Name of the Vulnerable Software and Affected Versions AMD Platform Configuration Blob APCB SMM driver affected versions not specified Description Incorrect use of boot service in the AMD Platform Configuration Blob APCB SMM driver could allow a privileged attacker with local access Ring 0 to...

Aligning Core Aspects: Improving Vulnerability Proof-Of-Concepts Via Cross-Source Insights

For vulnerabilities, Proof-of-Concept PoC plays an irreplaceable role in demonstrating the exploitability. PoC reports may include critical information such as specific usage, test platforms, and more, providing essential insights for researchers. However, in reality, due to various PoC templates...

Collaborative Intelligence: Topic Modelling of Large Language Model Use in Live Cybersecurity Operations

Objective: This work describes the topic modelling of Security Operations Centre SOC use of a large language model LLM, during live security operations. The goal is to better understand how these specialists voluntarily use this tool. Background: Human-automation teams have been extensively...

MalLoc: toward Fine-Grained Android Malicious Payload Localization Via LLMs

The rapid evolution of Android malware poses significant challenges to the maintenance and security of mobile applications apps. Traditional detection techniques often struggle to keep pace with emerging malware variants that employ advanced tactics such as code obfuscation and dynamic behavior...

Linux Distros Unpatched Vulnerability : CVE-2018-12322

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - There is a heap out of bounds read in radare2 2.6.0 in 6502op in libr/anal/p/anal6502.c via a crafted iNES ROM binary file. CVE-2018-12322 Note that Nessus reli...

MAL-2025-41348 Malicious code in byresfsdfdsdf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0b1380ef63b7b2c52e98cf7f5aebaa23316da368c8a3f7a00faf0e36b8fa8472 The OpenSSF Package Analysis project identified 'byresfsdfdsdf' @ 2.3.2 npm as malicious. It is considered malicious because: - The package...

Trust Me, I Know This Function: Hijacking LLM Static Analysis Using Bias

Large Language Models LLMs are increasingly trusted to perform automated code review and static analysis at scale, supporting tasks such as vulnerability detection, summarization, and refactoring. In this paper, we identify and exploit a critical vulnerability in LLM-based code analysis: an...

Malicious code in prettier-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis dd4a56ce83136ba0c08709c38d11bee44b0351d7dd9c5bca68b457fcb1b44be9 The OpenSSF Package Analysis project identified 'prettier-v2' @ 99.0.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-41345 Malicious code in prettier-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis dd4a56ce83136ba0c08709c38d11bee44b0351d7dd9c5bca68b457fcb1b44be9 The OpenSSF Package Analysis project identified 'prettier-v2' @ 99.0.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in typescript-5.6 (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7a01fda83028ac81fadc186832f18036fcd0c30fdddd56887177a977e57ad5e1 The OpenSSF Package Analysis project identified 'typescript-5.6' @...

Malicious code in suppressions (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9e3b924c14ff9c22bdc7afa4f89f7d776286be2e98bbbf1554f47af0a5944dc9 The OpenSSF Package Analysis project identified 'suppressions' @ 99.0...

MAL-2025-41324 Malicious code in rush-cyclic-dep-1 (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis dc3b2fad762b8091211ef41ee84b4321f34789e8957982339cb99ad5c439f9bf The OpenSSF Package Analysis project identified 'rush-cyclic-dep-1' @...

MAL-2025-41327 Malicious code in rushjs.io (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3d99306a850859fbf00f66d5e98426eded1c24eeb8f7b5e60f3255e4ad09c661 The OpenSSF Package Analysis project identified 'rushjs.io' @ 99.0.9...

MAL-2025-41323 Malicious code in rush-c (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 87ef3df74ad4f8e39b88d949f7728ee14fe93ba9ff8edb5efa5ca9a154630504 The OpenSSF Package Analysis project identified 'rush-c' @ 99.0.9 npm...

Malicious code in rehype-headerless-table-plugin (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5f663df30b939e46c2ebd664fc1dae15c177895427b67b8b2b3d646b000bc64f The OpenSSF Package Analysis project identified...

MAL-2025-41317 Malicious code in photo-agent (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5815b50954cc097d97f91fcab8cd626c3f40231a4b7950124b8308ff21ca1bd4 The OpenSSF Package Analysis project identified 'photo-agent' @ 99.0....

MAL-2025-41309 Malicious code in montage-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 285d4d62fe8147f0b104cedb1c1bc54ecc1a11483fb2240f89369ddd2de3b7d3 The OpenSSF Package Analysis project identified 'montage-agent' @ 99.0.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-41310 Malicious code in msalv1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 094e1e50bfda807b0aadbff380426c3058c835f4be9c1e5cc668a26665739454 The OpenSSF Package Analysis project identified 'msalv1' @ 99.0.9 npm as malicious. It is considered malicious because: - The package communicat...