CVE-2025-43275

CVE-2025-43275 is a race-condition vulnerability in macOS components where insufficient validation allowed an app to break out of its sandbox. The issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, and macOS Ventura 13.7.7. Affected products are macOS releases prior to these updates. The ...

Tea Dating Advice app has users’ private messages disclosed

A few days after Tea Dating Advice discovered unauthorized access to one of its systems that leaked 72,000 user images, the popular mobile app faced a second issue involving a separate database, as a researcher reported to 404Media that they were able to access private conversations. Tea Dating...

CVE-2025-6636 PRT File Parsing Use-After-Free Vulnerability

A maliciously crafted PRT file, when parsed through certain Autodesk products, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process...

Allianz Life says majority of 1.4 million US customers’ info breached

Insurance company Allianz Life was breached, exposing the data of most of its 1.4 million American customers. According to Allianz, an attacker gained access to a third-party, cloud-based Customer Relationship Management CRM system through social engineering. The company filed a data breach...

How the FBI got everything it wanted (re-air) (Lock and Code S06E15)

This week on the Lock and Code podcast… For decades, digital rights activists, technologists, and cybersecurity experts have worried about what would happen if the US government secretly broke into people’s encrypted communications. The weird thing, though, is that, in 2018, it already happened...

Allianz Life Data Breach Hits 1.4 Million Customers

Allianz Life Insurance confirms a July 2025 data breach impacting 1.4 million customers, financial pros and employees. Learn how social engineering exploited a third-party CRM, the hallmarks of Scattered Spider tactics, and the broader risks of supply chain vulnerabilities...

Aeroflot Hacked

Looks serious...

How Scattered Spider Used Fake Calls to Breach Clorox via Cognizant

Specops Software's analysis reveals how Scattered Spider's persistent help desk exploitation cost Clorox $400 million. Understand the August 2023 breach, its operational disruption, and critical steps organisations must take to protect against similar social engineering threats...

Toptal GitHub Breach Exposes 73 Repositories and Injects Malware into 10 npm Packages

In what's the latest instance of a software supply chain attack, unknown threat actors managed to compromise Toptal's GitHub organization account and leveraged that access to publish 10 malicious packages to the npm registry. The packages contained code to exfiltrate GitHub authentication tokens...

Tea App Breach: Women Only Dating Platform Leaks 72K User Images

The "Tea" app, a new and popular social platform for women, confirmed a major data breach affecting users…...

The vulnerability of the hid_bpfdestroy_device() function in the HID component of the Linux kernel allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the hidbpfdestroydevice function in the HID component of the Linux kernel is related to improper elimination of certain elements in the output data. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

Skops 安全漏洞

Skops is a Python library from the Skops project that helps share scikit-learn-based models and put them into production. A security vulnerability exists in Skops 0.11.0 and earlier versions, which stems from OperatorFuncNode inconsistencies and could lead to arbitrary code execution...

Skops 安全漏洞

Skops is a Python library from the Skops project that helps share scikit-learn-based models and put them into production. A security vulnerability exists in Skops 0.11.0 and earlier versions, which stems from a MethodNode inconsistency that could lead to arbitrary code execution...

NASCAR Confirms Medusa Ransomware Breach After $4M Demand

Medusa Ransomware breached NASCAR, demanded $4 million, leaked sensitive data including maps and staff info, exposing major security failures. The incident was exclusively reported by Hackread.com...

Overcoming Risks from Chinese GenAI Tool Usage

A recent analysis of enterprise data suggests that generative AI tools developed in China are being used extensively by employees in the US and UK, often without oversight or approval from security teams. The study, conducted by Harmonic Security, also identifies hundreds of instances in which...

xonPlus Launches Real-Time Breach Alerting Platform for Enterprise Credential Exposure

Chennai, India, 25th July 2025, CyberNewsWire...

CVE-2015-10143

The Platform theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the ajaxsaveoptions function in all versions up to 1.4.4 exclusive. This makes it possible for unauthenticated attackers to update arbitra...

CVE-2015-10143

The CVE-2015-10143 entry concerns the Platform theme for WordPress prior to version 1.4.4, where a missing capability check in the _ajax_save_options() function allows unauthenticated modification of options. Affects the Platform theme (WordPress Platform) and enables updating arbitrary site opti...

ChanCMS 安全漏洞

ChanCMS is a content management system by yanyutao0402 individual developer in China. A security vulnerability exists in ChanCMS 3.1.2 and earlier versions, which originates from the incorrect operation of the function getArticle on the parameter targetUrl in the file...

WeGIA SQL Injection Vulnerability (CNVD-2025-17268)

WeGIA is a web manager for welfare organizations. WeGIA suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the /html/funcionario/profiledependente.php endpoint iddependente parameter. An attacker could exploit this...