Happy 16th Birthday, KrebsOnSecurity.com!

KrebsOnSecurity.com celebrates its 16th anniversary today! A huge "thank you" to all of our readers -- newcomers, long-timers and drive-by critics alike. Your engagement this past year here has been tremendous and truly a salve on a handful of dark days. Happily, comeuppance was a strong theme...

CVE-2025-14175 Weak Algorithm Support in SSH Server on TL-WR820N

A vulnerability in the SSH server of TP-Link TL-WR820N v2.80 allows the use of a weak cryptographic algorithm, enabling an adjacent attacker to intercept and decrypt SSH traffic. Exploitation may expose sensitive information and compromise confidentiality...

UxPlay 安全漏洞

UxPlay is an AirPlay server software by antimof individual developers. A security vulnerability exists in UxPlay version 1.72, which stems from the presence of a double release for RTSP request processing, which could lead to a denial of service...

SmarterTools SmarterMail 安全漏洞

SmarterTools SmarterMail is a suite of mail server software from SmarterTools. The software supports spam filtering, statistics, Simple Mail Transfer Protocol SMTP authentication, and other features. A security vulnerability exists in SmarterTools SmarterMail that originates from an unauthenticat...

Sokol 缓冲区错误漏洞

Sokol is a platform interface for Andre Weissflog individual developers. A security vulnerability exists in Sokol, which stems from a stack buffer overflow in the function sgpipelinedescdefaults in the library sokolgfx.h. The vulnerability is caused by a stack buffer overflow in the function...

ZKTeco BioTime 安全漏洞

ZKTeco BioTime is a powerful web-based time and attendance management software from the Chinese company ZKTeco. A security vulnerability exists in ZKTeco BioTime versions 9.0.3, 9.0.4, and 9.5.2, which stems from a vulnerability in the parameter...

Hacker Leaks 2.3M Wired.com Records, Claims 40M-User Condé Nast Breach

A hacker using the alias "Lovely" has leaked what they claim is the personal data of over 2.3…...

ROS-20251226-7302

A vulnerability in the Twisted network framework is related to the failure to take measures to protect the structure of a web page. Exploitation of the vulnerability allows a remote attacker to gain access to sensitive data and compromise its integrity...

Cloudlog 安全漏洞

Cloudlog is a self-hosted PHP application by the individual developer Peter Goodhall. Allows logging of amateur radio contacts from anywhere. A security vulnerability exists in Cloudlog version 2.6.15 that stems from a blind time-based SQL injection vulnerability in the qsoresults parameter...

LastPass 2022 Breach Led to Years-Long Cryptocurrency Thefts, TRM Labs Finds

The encrypted vault backups stolen from the 2022 LastPass data breach have enabled bad actors to take advantage of weak master passwords to crack them open and drain cryptocurrency assets as recently as late 2025, according to new findings from TRM Labs. The blockchain intelligence firm said...

MAL-2026-170 Malicious code in secguest-react-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b76ab99d9a667e9700bb0176dde546ff3748b742775ea322766035a730391891 The package secguest-react-lib was found to contain malicious code. Source: ghsa-malware...

📄 MagnusBilling 6 Server-Side Request Forgery / Path Traversal

Proof of concept exploit for MagnusBilling 6 vulnerabilities including server-side request forgery, path traversal, and cryptographic weaknesses. ============================================================================================================================================= | Title :...

Linksys E5600 安全漏洞

Linksys E5600 is a powerful, compact and reliable WiFi 5 router from Linksys, Inc. A security vulnerability exists in Linksys E5600 version V1.1.0.26, which originates from a command injection in the runtime.macClone function via the mc.ip parameter...

OrangeScrum 安全漏洞

Orangescrum is a project and task management software tool that also provides productivity tools for work organization and team collaboration. Orangescrum suffers from an elevation of privilege vulnerability, which stems from the application's failure to effectively verify the source of requests ...

RealDefense SUPERAntiSpyware 安全漏洞

RealDefense SUPERAntiSpyware is a security tool for detecting and removing malware from RealDefense USA. A security vulnerability exists in RealDefense SUPERAntiSpyware that stems from SAS Core Service exposing dangerous functions that could lead to local elevation of privilege...

TechStore 安全漏洞

TechStore is a subscription software platform from TechStore Inc. in the United Arab Emirates. A security vulnerability exists in TechStore version 1.0, which stems from the id parameter not being encoded or cleaned up, which could lead to a reflective cross-site scripting attack...

RealDefense SUPERAntiSpyware 安全漏洞

RealDefense SUPERAntiSpyware is a security tool for detecting and removing malware from RealDefense USA. A security vulnerability exists in RealDefense SUPERAntiSpyware that stems from SAS Core Service exposing dangerous functions that could lead to local elevation of privilege...

Microsoft Is Finally Killing RC4

After twenty-six years, Microsoft is finally upgrading the last remaining instance of the encryption algorithm RC4 in Windows. of the most visible holdouts in supporting RC4 has been Microsoft. Eventually, Microsoft upgraded Active Directory to support the much more secure AES encryption standard...

Pornhub tells users to expect sextortion emails after data exposure

After a recent data breach that affected Pornhub Premium members, Pornhub has updated its online statement to warn users about potential direct contact from cybercriminals. “We are aware that the individuals responsible for this incident have threatened to contact impacted Pornhub Premium users...

GT Edge AI 安全漏洞

GT Edge AI is an edge AI solution from US-based GT Edge AI. A security vulnerability exists in versions prior to GT Edge AI v2.0.10-dev, which stems from improper access control of the /api/v1/conversations//messages API, which could lead to unauthorized access to other users' message history...