13200 matches found
MAL-2025-5655 Malicious code in maliinn (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 dea697dc03b11e99e6895070c9fa053b8db92510a03201f9545dcb25bd373199 The only goal of the package is to execute a webhook or a suspicious file during installation. Closely related to 2025-07-0x9xnx - created after previous...
MAL-2025-5653 Malicious code in hellodista (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 988e08e45c0c2fdbdf337e012d3930d14eedbe4add858a55cee2156849033b90 Series of packages mostly with an obfuscated infostealer attempting to collect Chrome data. While discord webhook is usually set to an example, there are other...
Malicious code in buzzwordcrm (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 940f87e50ab955b94dc0592711a21d19b9c1c962229c927531aef0816bf7ae2a Any computer that has this package installed or running should be considered...
Breaking the Bulkhead: Demystifying Cross-Namespace Reference Vulnerabilities in Kubernetes Operators
Kubernetes Operators, automated tools designed to manage application lifecycles within Kubernetes clusters, extend the functionalities of Kubernetes, and reduce the operational burden on human engineers. While Operators significantly simplify DevOps workflows, they introduce new security risks. I...
We Urgently Need Privilege Management in MCP: a Measurement of API Usage in MCP Ecosystems
The Model Context Protocol MCP has emerged as a widely adopted mechanism for connecting large language models to external tools and resources. While MCP promises seamless extensibility and rich integrations, it also introduces a substantially expanded attack surface: any plugin can inherit broad...
CBP Wants New Tech to Search for Hidden Data on Seized Phones
Customs and Border Protection is asking companies to pitch tools for performing deep analysis on the contents of devices seized at the US border...
Threat Exposure as a Narrative: If Attackers Tell a Story, Why Don’t We?
Running short on time but still want to stay in the know? Well, we’ve got you covered! We’ve condensed all the key takeaways into a handy audio summary. Our AI-driven podcasts are fit for on the go. Security teams are losing the communication battle to cybercriminals who intuitively understand...
Threat Exposure as a Narrative: If Attackers Tell a Story, Why Don’t We?
Running short on time but still want to stay in the know? Well, we’ve got you covered! We’ve condensed all the key takeaways into a handy audio summary. Our AI-driven podcasts are fit for on the go. Security teams are losing the communication battle to cybercriminals who intuitively understand...
Malicious code in rjs-test (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ff96ebaa9a7e9bad85ca95367b0a36f1c3374ba9f80ce3fc5aac0a53671cb5e7 Any computer that has this package installed or running should be considered...
CVE-2025-38159
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds Set the size to 6 instead of 2, since 'para' array is passed to 'rtwfwbtwificontrolrtwdev, para0, ¶1', which reads 5 bytes: void rtwfwbtwificontrolstruct...
CVE-2025-38159
CVE-2025-38159: Linux kernel wifi/rtw88 fix to prevent out-of-bounds read by enlarging the para buffer from 2 to 6 bytes, since code reads data[0]..data[4] in rtw_fw_bt_wifi_control. Affected component is the kernel’s wifi driver, with Svace-detected reading that could access 5 bytes. Patch/mitig...
CVE-2025-38159 wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds Set the size to 6 instead of 2, since 'para' array is passed to 'rtwfwbtwificontrolrtwdev, para0, ¶1', which reads 5 bytes: void rtwfwbtwificontrolstruct...
PT-2025-27780 · Endress+Hauser · Endress+Hauser Meac300-Fnade4
Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue arises from the application's behavior of returning different error messages for failed login attempts, depending on whether the failure was due to an incorrect password or a...
MAL-2025-5538 Malicious code in k6-studio (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7b163d493761fa12ed8094157415651ec1b22824f021a7483637346825e08cca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-5537 Malicious code in @frontend-clients/design-system (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7fe458099d7b7c0662a9f2283b87071d2afc98b120e402fc20ce916a5b5962ff The OpenSSF Package Analysis project identified '@frontend-clients/design-system' @ 10.0.0 npm as malicious. It is considered malicious because:...
Malicious code in helioviewer.org (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 40173395fee816f71bb3a20b762c39e1bd65badaed05ef884c1e4083b7e84107 Any computer that has this package installed or running should be considered...
Malicious code in dds-js (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d47ebdc1891b1fd02986098c63e73de75cf01ce8c67fc24f74ec39c86a04e866 The OpenSSF Package Analysis project identified 'dds-js' @ 2.4.0 npm ...
Exploit for Inclusion of Functionality from Untrusted Control Sphere in Sudo_Project Sudo
About This Project This project was developed as part of the...
MAL-2025-5339 Malicious code in microviewsharedwidgets (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4a0d5ab634b9ee74c4cf591a4cb1b7f151f6f7116e6cd32bcfd80464d278f1df The OpenSSF Package Analysis project identified...
