Khan Academy: 337k users and 1 employee leaked credentials

The Khan Academy website experienced a data breach, resulting in the leakage of 337.7k user accounts and one employee account. The leaked credentials, including email addresses and passwords, were discovered on a website called "leakradar.io"...

SEMCMS 安全漏洞

SEMCMS is SEMCMS open source content management system CMS for foreign trade websites that supports multi-language. A security vulnerability exists in SEMCMS v5.0, which originates from SQL injection of ID parameter in SEMCMSInquiryView.php...

SEMCMS 安全漏洞

SEMCMS is SEMCMS open source content management system CMS for foreign trade websites that supports multi-language. A security vulnerability exists in SEMCMS v5.0, which originates from SQL injection of the pid parameter in SEMCMSInfocategories.php...

LaRecipe 安全漏洞

LaRecipe is a software by Saleem Hadad سليم حداد individual developer that uses MarkDown to write and publish documentation for Laravel applications. A security vulnerability exists in LaRecipe versions prior to 2.8.1 that stems from server-side template injection and could lead to remote code...

The vulnerability in the Transport Driver Interface (TDI) driver of Microsoft Windows operating systems allows a malicious actor to disclose protected information.

The vulnerability of the Transport Driver Interface TDI driver in Microsoft operating systems and Windows is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information that should be protecte...

HGiga iSherlock 安全漏洞

HGiga iSherlock is a series of software products from China Henderson HGiga. A security vulnerability exists in HGiga iSherlock that originates from OS command injection and could lead to remote code execution...

SEMCMS 安全漏洞

SEMCMS is SEMCMS open source content management system CMS for foreign trade websites that supports multi-language. A security vulnerability exists in SEMCMS v5.0, which originates from SQL injection of the lgid parameter in SEMCMSLink.php...

The vulnerability of the BitLocker data protection function in Microsoft Windows operating systems allows attackers to circumvent existing security restrictions.

The vulnerability of the BitLocker data protection function in Microsoft Windows operating systems is related to a breach of the data protection mechanism. Exploiting this vulnerability can allow attackers to circumvent existing security restrictions...

Malicious code in xpvnsulc (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 88e144cce5913bd8b818e88d9308fd1c10c0c7d58d905c8e570425d7c5f7ec49 Any computer that has this package installed or running should be considered...

MAL-2025-5989 Malicious code in target_user_list (npm)

The package communicates with a domain associated with malicious activity. It exfiltrates user data via wget in preinstall and test scripts. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ccbd7ef3804411c704a4a194010ead12c2e4f14bb09c560be7a4a4c5269e9dbb Any computer...

MAL-2025-5984 Malicious code in @3kali182/selenium-webdriver4 (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bff78cc4315b550d5909b8c816e780ca2f8d9a2faf17fcf35ec85eecdec84644 Any computer that has this package installed or running should be considered...

CVE-2025-53669

Jenkins VAddy Plugin 1.2.8 and earlier does not mask Vaddy API Auth Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them...

OESA-2025-1755 mod_security security update

Security Fixes: A vulnerability was found in OWASP ModSecurity 2.9.8/2.9.10 and classified as critical.Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary...

The vulnerability of the trusted execution environment of the Virtualization-Based Security (VBS) Enclave in Microsoft Windows operating systems allows attackers to enhance their privileges.

The vulnerability of the trusted execution environment for the Virtualization-Based Security VBS Enclave in Microsoft Windows operating systems is related to a breach of the data protection mechanism. Exploiting this vulnerability can allow attackers to enhance their privileges...

GIGABYTE Chipsets 安全漏洞

GIGABYTE Chipsets is a series of chipsets open-sourced by GIGABYTE of Taiwan, China. A security vulnerability exists in GIGABYTE Chipsets that originates from an unverified pointer and could lead to arbitrary memory writes and elevation of privilege...

The vulnerability of the Windows GDI component in Microsoft Windows operating systems allows attackers to disclose protected information.

The vulnerability of the Windows GDI component in Microsoft Windows systems is related to a breach of data protection mechanisms. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose protected information...

CVE-2025-5040

Autodesk Revit is affected by CVE-2025-5040: parsing a malicious RTE file can trigger a Heap-Based Overflow in the RTE parser, potentially causing a crash, reading sensitive data, or executing arbitrary code in the current process. Several connected sources corroborate heap overflow/RCE vectors v...

LlamaIndex 安全漏洞

LlamaIndex is a data framework for LLM applications open-sourced by LlamaIndex. A security vulnerability exists in LlamaIndex version 0.12.28 and earlier, which stems from the use of MD5 hashing to generate document block IDs, which could lead to hash conflicts...

MAL-2025-5747 Malicious code in @nomicsfoundation/sdk-test1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dd1a561b2ed5703af862c67f4c412afa3ba942efe78ee0b7fc55066fc7c8c316 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

McDonald’s AI Hiring Bot Exposed Millions of Applicants' Data to Hackers Using the Password ‘123456’

Basic security flaws left the personal info of tens of millions of McDonald’s job-seekers vulnerable on the “McHire” site built by AI software firm Paradox.ai...