WestJet Confirms Passenger IDs and Passports Stolen in Cyberattack

WestJet confirms a data breach starting June 13, 2025, stole passport/ID and personal data. Credit cards and passwords are safe. The airline offers 24 months of free identity monitoring, including $1M insurance...

2025 Cybersecurity Reality Check: Breaches Hidden, Attack Surfaces Growing, and AI Misperceptions Rising

Bitdefender's 2025 Cybersecurity Assessment Report paints a sobering picture of today's cyber defense landscape: mounting pressure to remain silent after breaches, a gap between leadership and frontline teams, and a growing urgency to shrink the enterprise attack surface. The annual research...

CVE-2025-57254

An SQL injection vulnerability in user-login.php and index.php of Karthikg1908 Hospital Management System HMS 1.0 allows remote attackers to execute arbitrary SQL queries via the username and password POST parameters. The application fails to properly sanitize input before embedding it into SQL...

PoDoFo 安全漏洞

PoDoFo is a free portable C++ library open-sourced by PoDoFo. A security vulnerability exists in podofo versions v0.10.0 through v0.10.5, which stems from a post-release reuse issue in the PdfTokenizer::ReadDictionary function that could lead to a denial of service attack...

Kazaar 安全漏洞

Kazaar is a print marketing fulfillment platform from Kazaar, Inc. A security vulnerability exists in Kazaar version 1.25.12 that stems from allowing the use of a JWT with an alg field of none, which could lead to authentication bypass...

Kazaar 安全漏洞

Kazaar is a print marketing fulfillment platform from Kazaar, Inc. A security vulnerability exists in Kazaar version 1.25.12 that stems from allowing modification of the order-id parameter, which could lead to an insecure direct object reference attack...

Suricata 安全漏洞

Suricata is a network IDS, IPS and NSM engine from the Open Information Security Foundation. A security vulnerability exists in Suricata version 8.0.0 that stems from the use of the ldap.responses.attributetype keyword and transformations that could lead to a stack buffer overflow...

nopCommerce 安全漏洞

nopCommerce is an open source, general purpose e-commerce platform from nopCommerce, Inc. A security vulnerability exists in nopCommerce version 4.40.3 that stems from improper product name input cleanup and could lead to a cross-site scripting attack...

CVE-2025-10725 Openshift-ai: overly permissive clusterrole allows authenticated users to escalate privileges to cluster admin

A flaw was found in Red Hat Openshift AI Service. A low-privileged attacker with access to an authenticated account, for example as a data scientist using a standard Jupyter notebook, can escalate their privileges to a full cluster administrator. This allows for the complete compromise of the...

CVE-2025-10725 Openshift-ai: overly permissive clusterrole allows authenticated users to escalate privileges to cluster admin

A flaw was found in Red Hat Openshift AI Service. A low-privileged attacker with access to an authenticated account, for example as a data scientist using a standard Jupyter notebook, can escalate their privileges to a full cluster administrator. This allows for the complete compromise of the...

Hack of US Surveillance Provider RemoteCOM Exposes Court Data

A massive data breach at RemoteCOM exposed 14,000 personal files and police contacts from the SCOUT software. Learn what this aggressive spyware records, and the high risks for all involved parties...

PT-2025-40010

Name of the Vulnerable Software and Affected Versions Karthikg1908 Hospital Management System HMS version 1.0 Description An SQL injection issue exists in the user-login.php and index.php files. The application does not properly sanitize input before using it in SQL queries. This allows remote...

PT-2025-40011

Name of the Vulnerable Software and Affected Versions Red Hat OpenShift AI versions 2.19 through 2.21 Description A critical flaw exists in Red Hat OpenShift AI Service that allows a low-privileged authenticated user, such as a data scientist using a Jupyter notebook, to escalate their privileges...

Collegetivity 安全漏洞

Collegetivity is a university student activity system by the individual developer Syauqizaidan Khairan Khalaf. A security vulnerability exists in Collegetivity version 1.0.0, which stems from the presence of an insecure direct object reference in the /dashboard/notes endpoint, which could allow a...

CVE-2025-52043

In Frappe ERPNext v15.57.5, the function importcoa at erpnext/accounts/doctype/chartofaccountsimporter/chartofaccountsimporter.py is vulnerable to SQL injection, which allows an attacker to extract all information from databases by injecting a SQL query into the company parameter...

Harrods Data Breach: 430,000 Customer Records Stolen Via Third-Party Attack

Luxury retailer Harrods confirms 430,000 customer records names, contacts were stolen from a third-party provider in the latest UK retail cyberattack wave...

Sex offenders, terrorists, drug dealers, exposed in spyware breach

We've covered spyware and stalkerware leaks many times before, but we don't often see such exposure in software used by law enforcement. According to a report by Straight Arrow News SAN, the hacker “wikkid” said the intrusion against RemoteCOM was “one of the easiest” they’d ever carried out...

MyCourts 安全漏洞

MyCourts is a court management platform from MyCourts UK. A security vulnerability exists in MyCourts v3, which stems from a lack of input validation in the LTA number profile field, which could lead to a stored cross-site scripting attack, and could be exploited to hijack a user session due to t...

Mealie 安全漏洞

Mealie is a self-hosted recipe manager and meal planner by an individual developer in Hayden, USA. A security vulnerability exists in Mealie 3.0.1 and prior versions, which stems from the failure to clean and escape user input in the note and text fields in the recipe creation feature, which coul...

OpenIndiana 安全漏洞

OpenIndiana is an operating system from OpenIndiana Open Source. A security vulnerability exists in OpenIndiana 5.11 that stems from insufficient validation of sequence number ranges in TCP packet processing, which could lead to a denial of service attack...