Your Guide to Risk-Based Vulnerability Management

Communicating security needs to leadership can be a challenge when you’re just presenting a long list of technical flaws. The conversation shifts when you can talk about risk in clear business terms. Instead of saying "we have 500 critical vulnerabilities," you can say "we have 15 vulnerabilities...

CISA Releases Four Industrial Control Systems Advisories

CISA released four Industrial Control Systems ICS Advisories. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-310-01 Advantech DeviceOn iEdge ICSA-25-310-02 Ubia Ubox ICSA-25-310-03 ABB FLXeon Controllers...

What Is Attack Surface Mapping And Why It’s Critical To your Security Program

You might think an attack surface mapper is just another name for a vulnerability scanner, but they serve two very different purposes. A scanner tests the assets you already know about for specific weaknesses. An attack surface mapper answers a more fundamental question: What assets do I even hav...

CGA-GF3R-G478-F9C8

Bulletin has no description...

What Are Attack Surface Intelligence Exposures?

Do you know every single digital asset your organization owns? For most security leaders, the honest answer is no. Between shadow IT, forgotten development servers, and complex cloud environments, your true attack surface is full of blind spots. These unknown and unmanaged assets are where...

Missing Authorization

com.liferay, com.liferay.asset.display.page.service is vulnerable to Missing Authorization. The vulnerability is due to missing authorization checks when users attempt to view display page templates, which allows an attacker to access these templates through crafted URLs...

The vulnerability of the SKYSEA Client View software for managing IT assets stems from deficiencies in the authentication process, allowing attackers to execute arbitrary code.

The vulnerability of the SKYSEA Client View software for managing IT assets is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Malicious code in epic-asset-uploader-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 168bca602c07dee020253d5302f18b0f0f5fb783801ac20450da5073f282042b The package epic-asset-uploader-ui was found to contain malicious code...

EUVD-2025-37175

Malicious code in epic-asset-uploader-ui npm...

MAL-2025-49118 Malicious code in epic-asset-uploader-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 168bca602c07dee020253d5302f18b0f0f5fb783801ac20450da5073f282042b The package epic-asset-uploader-ui was found to contain malicious code...

Malicious code in named-asset-import (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 41aa2c9de0b9bf1fc5a9cbee9d0442255a36d349e4645660908d01b2ac8db820 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2025-36866

Malicious code in named-asset-import npm...

MAL-2025-49024 Malicious code in named-asset-import (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 41aa2c9de0b9bf1fc5a9cbee9d0442255a36d349e4645660908d01b2ac8db820 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-41090

microCLAUDIA in v3.2.0 and prior has an improper access control vulnerability. This flaw allows an authenticated user to perform unauthorized actions on other organizations' systems by sending direct API requests. To do so, the attacker can use organization identifiers obtained through a...

CVE-2025-41090 Improper Access Control in CCN-CERT microCLAUDIA

microCLAUDIA in v3.2.0 and prior has an improper access control vulnerability. This flaw allows an authenticated user to perform unauthorized actions on other organizations' systems by sending direct API requests. To do so, the attacker can use organization identifiers obtained through a...

CVE-2025-41090 Improper Access Control in CCN-CERT microCLAUDIA

microCLAUDIA in v3.2.0 and prior has an improper access control vulnerability. This flaw allows an authenticated user to perform unauthorized actions on other organizations' systems by sending direct API requests. To do so, the attacker can use organization identifiers obtained through a...

CVE-2025-41090

CVE-2025-41090 concerns microCLAUDIA, affecting version 3.2.0 and older. The issue is an improper access-control vulnerability that allows an authenticated user to perform actions on other organizations’ systems by issuing direct API requests, using organization identifiers obtained from a compro...

PT-2025-44091

Name of the Vulnerable Software and Affected Versions microCLAUDIA versions prior to 3.2.0 Description An improper access control issue exists in microCLAUDIA. An authenticated user can perform unauthorized actions on other organizations' systems by sending direct API requests. Attackers can...

Cloud Attack Surface Management Mapping 101

Before an attacker launches an assault, they do their homework. Their first step is to meticulously map your digital footprint, searching for the path of least resistance—an exposed database, an unpatched server, or a forgotten subdomain. The reality is that your attack surface is already being...

The vulnerability of the 3D model rendering software Luxion KeyShot lies in the overflow of buffers in dynamic memory, allowing an attacker to execute arbitrary code.

The vulnerability of the Luxion KeyShot 3D modeling rendering software lies in the overflow of buffers in dynamic memory during the processing of DAE format files. Exploiting this vulnerability allows an attacker to execute arbitrary code...