InsydeH2O 安全漏洞

InsydeH2O is a customizable firmware code base from China Insyde Insyde. A security vulnerability exists in InsydeH2O that originates from a corrupted SMM memory in the SMM module...

PrestaShop 安全漏洞

PrestaShop is an open source e-commerce solution from the American company PrestaShop. The solution provides multiple payment methods, short message alerts and product image scaling. A security vulnerability exists in PrestaShop version v8.2.0, which stems from a PHAR deserialization issue in...

InsydeH2O 安全漏洞

InsydeH2O is a customizable firmware codebase from China-based Insyde Insyde. A security vulnerability exists in InsydeH2O that originates from a stack overflow in the SMI handler...

Electronic Hub playground.electronhub.ai 安全漏洞

Electronic Hub playground.electronhub.ai is an AI big modeling platform from Electronic Hub, Inc. A security vulnerability exists in Electronic Hub playground.electronhub.ai v1.1.9, which originates from cross-site scripting...

Elastic 安全漏洞

Elastic is a suite of open source distributed RESTful search engines built on Lucene by Elastic Netherlands. The product is primarily used in cloud computing and supports data indexing using JSON over HTTP. A security vulnerability exists in Elastic that stems from improper handling of directory...

CVE-2025-43275

CVE-2025-43275 is a race-condition vulnerability in macOS components where insufficient validation allowed an app to break out of its sandbox. The issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, and macOS Ventura 13.7.7. Affected products are macOS releases prior to these updates. The ...

Tea Dating Advice app has users’ private messages disclosed

A few days after Tea Dating Advice discovered unauthorized access to one of its systems that leaked 72,000 user images, the popular mobile app faced a second issue involving a separate database, as a researcher reported to 404Media that they were able to access private conversations. Tea Dating...

CVE-2025-6636 PRT File Parsing Use-After-Free Vulnerability

A maliciously crafted PRT file, when parsed through certain Autodesk products, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process...

Allianz Life says majority of 1.4 million US customers’ info breached

Insurance company Allianz Life was breached, exposing the data of most of its 1.4 million American customers. According to Allianz, an attacker gained access to a third-party, cloud-based Customer Relationship Management CRM system through social engineering. The company filed a data breach...

How the FBI got everything it wanted (re-air) (Lock and Code S06E15)

This week on the Lock and Code podcast… For decades, digital rights activists, technologists, and cybersecurity experts have worried about what would happen if the US government secretly broke into people’s encrypted communications. The weird thing, though, is that, in 2018, it already happened...

Allianz Life Data Breach Hits 1.4 Million Customers

Allianz Life Insurance confirms a July 2025 data breach impacting 1.4 million customers, financial pros and employees. Learn how social engineering exploited a third-party CRM, the hallmarks of Scattered Spider tactics, and the broader risks of supply chain vulnerabilities...

Aeroflot Hacked

Looks serious...

How Scattered Spider Used Fake Calls to Breach Clorox via Cognizant

Specops Software's analysis reveals how Scattered Spider's persistent help desk exploitation cost Clorox $400 million. Understand the August 2023 breach, its operational disruption, and critical steps organisations must take to protect against similar social engineering threats...

Toptal GitHub Breach Exposes 73 Repositories and Injects Malware into 10 npm Packages

In what's the latest instance of a software supply chain attack, unknown threat actors managed to compromise Toptal's GitHub organization account and leveraged that access to publish 10 malicious packages to the npm registry. The packages contained code to exfiltrate GitHub authentication tokens...

Tea App Breach: Women Only Dating Platform Leaks 72K User Images

The "Tea" app, a new and popular social platform for women, confirmed a major data breach affecting users…...

The vulnerability of the hid_bpfdestroy_device() function in the HID component of the Linux kernel allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the hidbpfdestroydevice function in the HID component of the Linux kernel is related to improper elimination of certain elements in the output data. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

Skops 安全漏洞

Skops is a Python library from the Skops project that helps share scikit-learn-based models and put them into production. A security vulnerability exists in Skops 0.11.0 and earlier versions, which stems from OperatorFuncNode inconsistencies and could lead to arbitrary code execution...

Skops 安全漏洞

Skops is a Python library from the Skops project that helps share scikit-learn-based models and put them into production. A security vulnerability exists in Skops 0.11.0 and earlier versions, which stems from a MethodNode inconsistency that could lead to arbitrary code execution...

NASCAR Confirms Medusa Ransomware Breach After $4M Demand

Medusa Ransomware breached NASCAR, demanded $4 million, leaked sensitive data including maps and staff info, exposing major security failures. The incident was exclusively reported by Hackread.com...

Overcoming Risks from Chinese GenAI Tool Usage

A recent analysis of enterprise data suggests that generative AI tools developed in China are being used extensively by employees in the US and UK, often without oversight or approval from security teams. The study, conducted by Harmonic Security, also identifies hundreds of instances in which...