The vulnerability of microprogramming software in embedded Qualcomm chips, related to unverified array indexing, allows a hacker to execute arbitrary code, cause system failures, or gain unauthorized access to protected information.

The vulnerability of microprogramming software in embedded Qualcomm chips is related to unverified array indexing. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code, cause service failures, or gain unauthorized access to protected information...

SoundCloud 安全漏洞

SoundCloud is a music community application from SoundCloud. A security vulnerability exists in SoundCloud version 7.65.2, which originates in the session processing component and could allow a local attacker to elevate privileges and gain access to sensitive information...

CVE-2025-1508 WP Crowdfunding <= 2.1.14 - Missing Authorization to Authenticated (Subscriber+) Post Content Download

The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the downloaddata action in all versions up to, and including, 2.1.14. This makes it possible for authenticated attackers, with subscriber-level access and above, to download...

MAL-2025-2315 Malicious code in hardhat-ethers-react-ts-starter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f8762e2209b41b4f6eb94a4d56674ed8d23f5ecba64034e0825fe7490fea5c78 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Palo Alto Networks GlobalProtect 安全漏洞

Palo Alto Networks GlobalProtect is a suite of network protection software from Palo Alto Networks, USA. The software provides features such as firewall monitoring and threat prevention. A security vulnerability exists in Palo Alto Networks GlobalProtect that stems from a reliance on untrustworth...

PT-2025-11694

Name of the Vulnerable Software and Affected Versions reviewdog/action-setup version 1 Description The GitHub Action reviewdog/action-setup was compromised between March 11, 2025, 18:42 and 20:31 UTC with malicious code. This code dumps exposed secrets to GitHub Actions Workflow Logs. Actions tha...

ROS-20250312-01

The vulnerability of thejd drm/amd/display component of the Linux kernel is related to incorrect verification of the input data in the calculatettucursor function in the drivers/gpu/drm/amd/display/dc/dml/dcn21/displayrqdlgcalc21.c, in the calculatettucursor function in the...

AZL-62432 CVE-2025-27101 affecting package opal 3.10.11-13

Opal is OBiBa’s core database application for biobanks or epidemiological studies. Prior to version 5.1.1, when copying any parent directory to a folder in the /temp/ directory, all files in that parent directory are copied, including files which the user should not have access to. All users of t...

Silk Typhoon Hackers Indicted

Lots of interesting details in the story: The US Department of Justice on Wednesday announced the indictment of 12 Chinese individuals accused of more than a decade of hacker intrusions around the world, including eight staffers for the contractor i-Soon, two officials at China's Ministry of Publ...

CVE-2025-24078 Microsoft Word Remote Code Execution Vulnerability

...

CVE-2025-25267

A vulnerability has been identified in Tecnomatix Plant Simulation V2302 All versions V2302.0021, Tecnomatix Plant Simulation V2404 All versions V2404.0010. The affected application does not properly restrict the scope of files accessible to the simulation model. This could allow an unauthorized...

Huawei HarmonyOS media library module privilege checksum vulnerability (CNVD-2025-07255)

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A privilege checking vulnerability exists in the Huawei HarmonyOS media library module, which can be exploited by an attacker to compromise confidentiality...

The vulnerability of the personal assistant Siri in operating systems such as macOS, iOS, and iPadOS allows a hacker to disclose protected information.

The vulnerability of the personal assistant Siri in operating systems such as macOS, iOS, and iPadOS is related to a breach of data protection mechanisms. Exploiting this vulnerability could allow an attacker to disclose protected information...

SAP Electronic Invoicing 安全漏洞

SAP Electronic Invoicing is an electronic invoice management solution from SAP, Germany. It is used for business electronic invoicing, bookkeeping, clearing and reconciliation. A security vulnerability exists in SAP Electronic Invoicing that originates from unauthorized access and could lead to...

How ads weirdly know your screen brightness, headphone jack use, and location, with Tim Shott (Lock and Code S06E05)

This week on the Lock and Code podcast … Something's not right in the world of location data. In January, a location data broker named Gravy Analytics was hacked, with the alleged cybercriminal behind the attack posting an enormous amount of data online as proof. Though relatively unknown to most...

Misskey 安全漏洞

Misskey is a perpetually free open source syndicated social media platform from Misskey Open Source. A security vulnerability exists in Misskey versions prior to 2025.2.1 that stems from insufficient validation of the relationship between the id and url fields of an ActivityPub object, which coul...

Information Kerala Mission SANCHAYA 安全漏洞

Information Kerala Mission SANCHAYA is a web-based application of the Information Kerala Mission Government of India department through which citizens can check their tax dues. A security vulnerability exists in Information Kerala Mission SANCHAYA v3.0.4. An attacker can exploit the vulnerability...

Nintex Automation 安全漏洞

Nintex Automation is a workflow automation software from Nintex. A security vulnerability exists in Nintex Automation versions prior to 5.8, which originates from a configuration file in the K2 SmartForms Designer folder that contains a password that can be read by an unauthorized user...

Mage AI 安全漏洞

Mage AI is a Mage open source intelligent program for building, running and managing data pipelines. A security vulnerability exists in Mage AI version 0.9.75 that stems from insecure resource initialization...

Feds Link $150M Cyberheist to 2022 LastPass Hacks

In September 2023, KrebsOnSecurity published findings from security researchers who concluded that a series of six-figure cyberheists across dozens of victims resulted from thieves cracking master passwords stolen from the password manager service LastPass in 2022. In a court filing this week, U....