Malicious code in geopost-web-component (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da57d3bad54c135655781ae00e108e90ad9a31f6eaa11327df5d4654a411f0d7 The package geopost-web-component was found to contain malicious code. Source: ghsa-malware...

MAL-2025-48947 Malicious code in geopost-web-component (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da57d3bad54c135655781ae00e108e90ad9a31f6eaa11327df5d4654a411f0d7 The package geopost-web-component was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-36470

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Disallow dirty tracking if incoherent page walk Dirty page tracking relies on the IOMMU atomically updating the dirty bit in the paging-structure entry. For this operation to succeed, the paging- structure memory must...

CVE-2025-40058

Technical details for CVE-2025-40058 are not publicly available in the provided documents. Monitor for updates.

MAL-2025-48949 Malicious code in test771 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39742384f3c2564e0528b3d94dc6b6cd66170e96d6a2818289c862bef030f39b The package test771 was found to contain malicious code. Source: ossf-package-analysis fbdb37fb2238599fb921d6fd14a8d65fdc19f6196377b91e304da671021e41...

Malicious code in test771 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39742384f3c2564e0528b3d94dc6b6cd66170e96d6a2818289c862bef030f39b The package test771 was found to contain malicious code. Source: ossf-package-analysis fbdb37fb2238599fb921d6fd14a8d65fdc19f6196377b91e304da671021e41...

SUSE CVE-2025-12198

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: Based on the analysis by MITRE and review of community feedback, the reported conditions represent expected and...

SUSE CVE-2025-12199

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: Based on the analysis by MITRE and review of community feedback, the reported conditions represent expected and...

EUVD-2025-36381

PILOS Platform for Interactive Live-Online Seminars is a frontend for BigBlueButton. Prior to 4.8.0, users with a local account can change their password while logged in. When doing so, all other active sessions are terminated, except for the currently active one. However, the current session’s...

AI Pulse: What Circadian Rhythms Reveal About AI Bot Behavior

...

curl: CURLX_SET_BINMODE(NULL) can call fileno(NULL) and cause undefined behavior / crash

Summary ------- Calling the CURLXSETBINMODEstream macro with stream == NULL leads to an unguarded call to filenoNULL in toolbinmode.h, which is undefined behavior and may crash the process. This is a robustness/UB issue and should be corrected by guarding against NULL streams before calling filen...

UBUNTU-CVE-2025-12199

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: Based on the analysis by MITRE and review of community feedback, the reported conditions represent...

Malicious code in gear-bridge-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 74e84b9a555df93618c5127eddd0b90f79c79e8b54a5c60a0deb241487f867d7 The OpenSSF Package Analysis project identified 'gear-bridge-common' @ 1337.1.0 npm as malicious. It is considered malicious because: - The...

HTTP Request Smuggling

Overview org.webjars.npm:hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to HTTP Request Smuggling via the CORS middleware, which copies the Vary header from the request to the response when the origin is not set to "". An attacker can influence...

CVE-2025-46183

The Utils.deserialize function in pgCodeKeeper 10.12.0 processes serialized data from untrusted sources. If an attacker provides a specially crafted .ser file, deserialization may result in unintended code execution or other malicious behavior on the target system...

Securing AI Agent Execution

Large Language Models LLMs have evolved into AI agents that interact with external tools and environments to perform complex tasks. The Model Context Protocol MCP has become the de facto standard for connecting agents with such resources, but security has lagged behind: thousands of MCP servers...

Updated thunderbird packgaes fix security vulnerabilities

CVE-2025-11708: Use-after-free in MediaTrackGraphImpl::GetInstance CVE-2025-11709: Out of bounds read/write in a privileged process triggered by WebGL textures CVE-2025-11710: Cross-process information leaked due to malicious IPC messages CVE-2025-11711: Some non-writable Object properties could ...

CVE-2025-62397 Moodle: router produces json instead of 404 error for invalid course id

The router’s inconsistent response to invalid course IDs allowed attackers to infer which course IDs exist, potentially aiding reconnaissance...

This ‘Privacy Browser’ Has Dangerous Hidden Features

The Universe Browser is believed to have been downloaded millions of times. But researchers say it behaves like malware and has links to Asia’s booming cybercrime and illegal gambling networks...

PT-2025-55490

Affected versions of stackvector contained multiple soundness issues that could allow safe Rust code to trigger undefined behavior. One issue was that StackVec::length was exposed as a public field. Safe Rust code could set length to a value larger than the backing array capacity. Other safe...