VirusTotal Finds 44 Undetected SVG Files Used to Deploy Base64-Encoded Phishing Pages

Cybersecurity researchers have flagged a new malware campaign that has leveraged Scalable Vector Graphics SVG files as part of phishing attacks impersonating the Colombian judicial system. The SVG files, according to VirusTotal, are distributed via email and designed to execute an embedded...

PT-2025-36259

Name of the Vulnerable Software and Affected Versions: ECOVACS vacuum robot base stations affected versions not specified Description: ECOVACS vacuum robot base stations do not validate firmware updates, allowing malicious over-the-air updates to be sent to the base station via an insecure...

CVE-2025-30198: Use of Hard-coded Cryptographic Key

ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic WPA2-PSK, which can be easily derived...

CVE-2025-30199: Download of Code Without Integrity Check

ECOVACS vacuum robot base stations do not validate firmware updates, so malicious over-the-air updates can be sent to base station via insecure connection between robot and base station...

CVE-2025-6984

An XML External Entity flaw has been discovered in the langchain-community python package. The EverNoteLoader component has an insecure use of the etree.iterparse function which does not disable external entity references. This can lead to sensitive information disclosure. An attacker could explo...

WordPress Knowledge Base theme <= 2.9 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Knowledge Base versions = 2.9...

CVE-2025-41050

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAddonlayouts' and 'dataAddonlayoutsexcept' parameters in /apprain/developer/addons/update/baselibs...

CVE-2025-41050 Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAddonlayouts' and 'dataAddonlayoutsexcept' parameters in /apprain/developer/addons/update/baselibs...

CVE-2025-9866

An inappropriate implementation in extensions flaw was found in Google Chrome. This vulnerability allows a remote attacker to bypass the content security policy via a crafted HTML page. Mitigation Mitigation for this issue is either not available or the currently available options don't meet the...

A vulnerability was found in DPDK versions 18.05 and above. A missing check for an integer overflow in vhost_user_set_log_base() could result in a smaller memory map than requested, possibly allowing memory corruption.

...

CVE-2025-58057

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted...

LoongArch: Set hugetlb mmap base address aligned with pmd size

...

Service workers could reveal script base URL due to dynamic `import()`. This vulnerability affects Firefox < 113.

...

appRain CMF 跨站脚本漏洞

appRain CMF is a content management framework. A cross-site scripting vulnerability exists in appRain CMF due to improper validation of user input in the /apprain/developer/addons/update/baselibs endpoint. An attacker could use this vulnerability to steal the victim's cookie-based authentication...

PT-2025-43325

Name of the Vulnerable Software and Affected Versions designthemes Knowledge Base versions prior to 2.9 Description A flaw exists in designthemes Knowledge Base that allows for Object Injection due to deserialization of untrusted data. This issue impacts the application’s ability to securely hand...

Debian dla-4291 : node-cipher-base - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4291 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4291-1 [email protected] https://www.debian.org/lts/security/...

Debian: Security Advisory (DLA-4291-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

An issue was discovered in Arm Mbed TLS before 2.24.0. An attacker can recover a private key (for RSA or static Diffie-Hellman) via a side-channel attack against generation of base blinding/unblinding values.

...

When checking if the Browsing Context had been discarded in `HttpBaseChannel`, if the load group was not available then it was assumed to have already been discarded which was not always the case for private channels after the private session had ended. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.

...

[SECURITY] [DLA 4291-1] node-cipher-base security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4291-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk September 03, 2025 https://wiki.debian.org/LTS -...