MAL-2025-190847 Malicious code in jan-browser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6061d20158eb6f2952932cac8bd818201360f36f2a4fd989357c12400c58a49b The package jan-browser was found to contain malicious code. Source: ghsa-malware a3954e4e8e77c870bfc41cd61410400a2f7ba85ce1d56123f2e672f63543e6e1 An...

Malicious code in jan-browser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6061d20158eb6f2952932cac8bd818201360f36f2a4fd989357c12400c58a49b The package jan-browser was found to contain malicious code. Source: ghsa-malware a3954e4e8e77c870bfc41cd61410400a2f7ba85ce1d56123f2e672f63543e6e1 An...

EUVD-2025-198829

Malicious code in jan-browser npm...

Malicious code in mongland (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a003c7277ab04d5aec30eaa72b0f28b25c7534e6b036c381142300b3ac0bde9f Importing the module starts an infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-11-mescouille...

MAL-2025-191794 Malicious code in mongland (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a003c7277ab04d5aec30eaa72b0f28b25c7534e6b036c381142300b3ac0bde9f Importing the module starts an infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-11-mescouille...

Malicious code in zakuchienne (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6cab2f6ce1c1eec52747b1f7057550b9b35d3c4f6d8c04b51e37afd47c1e5625 Importing the module starts an infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-11-mescouille...

MAL-2025-191940 Malicious code in zakuchienne (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6cab2f6ce1c1eec52747b1f7057550b9b35d3c4f6d8c04b51e37afd47c1e5625 Importing the module starts an infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-11-mescouille...

Vulnerability of the DOM component: The Workers mechanism in Mozilla Firefox and Firefox ESR browsers allows attackers to bypass existing security restrictions.

Vulnerability of the DOM component: The Workers mechanism in Mozilla Firefox and Firefox ESR browsers is related to data protection vulnerabilities. Exploiting this vulnerability allows an attacker to bypass existing security restrictions remotely...

Vulnerability of the DOM component: Available in Mozilla Firefox and Firefox ESR browsers, this component allows attackers to bypass existing security restrictions.

Vulnerability of the DOM component: Core and HTML browsers like Mozilla Firefox and Firefox ESR are vulnerable due to a flaw in data protection mechanisms. Exploiting this vulnerability allows an attacker to bypass existing security restrictions remotely...

Malicious code in mescouilles (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c081f74035c370212a2a4d7ab34d10ddc29fdb634e9cedfeeebd407e43b15fae Importing the module starts an infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-11-mescouille...

MAL-2025-191790 Malicious code in mescouilles (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c081f74035c370212a2a4d7ab34d10ddc29fdb634e9cedfeeebd407e43b15fae Importing the module starts an infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-11-mescouille...

BIT-LIMESURVEY-2025-41075 Multiple vulnerabilities in Limesurvey

Vulnerability in LimeSurvey 6.13.0 in the endpoint /optin that causes infinite HTTP redirects when accessed directly. This behavior can be exploited to generate a Denegation of Service DoS attack, by exhausting server or client resources. The system is unable to break the redirect loop, which can...

Matrix Push C2 Uses Browser Notifications for Fileless, Cross-Platform Phishing Attacks

Bad actors are leveraging browser notifications as a vector for phishing attacks to distribute malicious links by means of a new command-and-control C2 platform called Matrix Push C2. "This browser-native, fileless framework leverages push notifications, fake alerts, and link redirects to target...

[SECURITY] Fedora 43 Update: gopass-jsonapi-1.16.0-1.fc43

Gopass Browser Bindings...

Building Browser Agents: Architecture, Security, and Practical Solutions

Browser agents enable autonomous web interaction but face critical reliability and security challenges in production. This paper presents findings from building and operating a production browser agent. The analysis examines where current approaches fail and what prevents safe autonomous operatio...

ToddyCat: your hidden email assistant. Part 1

Introduction Email remains the main means of business correspondence at organizations. It can be set up either using on-premises infrastructure for example, by deploying Microsoft Exchange Server or through cloud mail services such as Microsoft 365 or Gmail. However, some organizations do not...

Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

...

CVE-2025-61949

LogStare Collector contains a stored cross-site scripting vulnerability in UserManagement. If crafted user information is stored, an arbitrary script may be executed on the web browser of the user who logs in to the product's management page...

The Browser Company of New York Dia 安全漏洞

The Browser Company of New York Dia is an AI browser from The Browser Company of New York, USA. A security vulnerability exists in The Browser Company of New York Dia prior to version 1.6, which stems from a lack of notification alerts in full-screen mode and could lead to users being misled...

CVE-2025-41075

LimeSurvey 6.13.0 has a vulnerability in the /optin endpoint that causes infinite HTTP redirects, enabling a DoS by exhausting server or client resources. Multiple connected sources (NVD, OSV, Red Hat, CIRCL, Snyk) confirm the issue and its impact (service degradation, potential browser instabili...