EUVD-2025-34137

Malicious code in internal-greeter-utils npm...

Phoenix Contact多款产品 安全漏洞

Phoenix Contact QUINT4-UPS/24DC/24DC/10/EIP and others are an industrial grade DC uninterruptible power supply module from Phoenix Contact, Germany. A security vulnerability exists in a number of Phoenix Contact products. The vulnerability stems from the ability of an unauthenticated attacker to...

Low: docker

Issue Overview: Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. A firewalld vulnerability affects Moby releases before 28.0.0. When firewalld reloads, Docker fails...

Centreon 安全漏洞

Centreon is a set of open source system monitoring tools from the French company Centreon . The product provides monitoring capabilities for resources such as networks, systems and applications. A security vulnerability exists in Centreon versions 24.10.0 through 24.10.13, 24.04.0 through 24.04.1...

Why Unmonitored JavaScript Is Your Biggest Holiday Security Risk

Think your WAF has you covered? Think again. This holiday season, unmonitored JavaScript is a critical oversight allowing attackers to steal payment data while your WAF and intrusion detection systems see nothing. With the 2025 shopping season weeks away, visibility gaps must close now. Get the...

A week in security (October 6 – October 12)

Last week on Malwarebytes Labs: Apple voices concerns over age-check law that could put user privacy at risk Your passwords don’t need so many fiddly characters, NIST says Millions of very private chats exposed by two AI companion apps Fake VPN and streaming app drops malware that drains your ban...

EUVD-2025-33963

HCL Unica MaxAI Workbench is vulnerable to improper input validation. This allows attackers to exploit vulnerabilities such as SQL Injection, XSS, or command injection, leading to unauthorized access or data breaches, etc...

Burgerportaal 安全漏洞

Burgerportaal is a GPP-Woo open source site for reading public documents. A security vulnerability exists in Burgerportaal versions prior to 2.0.3, prior to 3.0.2, and prior to 4.0.1, which stems from the exposure of employee names and e-mail addresses in a web response, which could lead to...

📄 Packet Storm EXIF Data Disclosure

A bad code push allowed EXIF data to remain in some photos on Packet Storm. Our analysis shows only 0.004% of uploaded pictures were affected and they have all been stripped to ensure no further exposure. Fortunately, the affected pictures only include items related to an admin of the site and th...

PT-2025-41754

Name of the Vulnerable Software and Affected Versions HCL Unica MaxAI Workbench affected versions not specified Description The HCL Unica MaxAI Workbench software contains a flaw due to improper input validation. This can allow attackers to exploit issues like SQL Injection, Cross-Site Scripting...

MAL-2025-48308 Malicious code in vite-plugin-es6-babel (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04fac94db34a750bac1ae88f46269718450d383d01b84a102872d0a2f6748918 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Apple voices concerns over age-check law that could put user privacy at risk

Apple has raised concerns about a new Texas state law, SB 2420, which introduces age assurance requirements for app stores and app developers. One of its main objections is that the requirements are over the top and don’t take into account what the user is actually trying to do. Apple stated: “We...

Your passwords don’t need so many fiddly characters, NIST says

It’s once again time to change your passwords, but if one government agency has its way, this might be the very last time you do it. After nearly four years of work to update and modernize its guidance for how companies, organizations, and businesses should protect their systems and their...

MAL-2025-48286 Malicious code in mshops-web-metrics-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ecbec2aacbd449fd0cb4b36bd3ac061312dae30f2dc01a987af141e97998523 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in redirect-47cprv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 805fa2724922cd5611fa30b7edd9bbf19375b36b1d910e2e30a32bfcb07bbfdb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48155 Malicious code in redirect-eqtqym (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51dd748122a487e0ade7375c311b741f6c69a606fc7ebb2930ed1e5b8f9a9711 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Discord Says Hackers Stole 70,000 ID Photos, Dismisses Extortion Claims

70,000 Discord users had government ID photos and private data exposed via a third-party vendor breach. See Discord's full response and critical security steps to protect your identity...

Hackers Access SonicWall Cloud Firewall Backups, Spark Urgent Security Checks

SonicWall on Wednesday disclosed that an unauthorized party accessed firewall configuration backup files for all customers who have used the cloud backup service. "The files contain encrypted credentials and configuration data; while encryption remains in place, possession of these files could...

SaaS Breaches Start with Tokens - What Security Teams Must Watch

Token theft is a leading cause of SaaS breaches. Discover why OAuth and API tokens are often overlooked and how security teams can strengthen token hygiene to prevent attacks. Most companies in 2025 rely on a whole range of software-as-a-service SaaS applications to run their operations. However,...

Redragon ERP 安全漏洞

Redragon ERP is an enterprise management system for redragon individual developers. A security vulnerability exists in redragon-erp version 1.0 that stems from the default Shiro key and could lead to a deserialization attack...