WordPress SureForms plugin <= 1.13.1 - Cross-Site Request Forgery Protection Bypass via Improper Nonce Distribution vulnerability

Cross-Site Request Forgery Protection Bypass via Improper Nonce Distribution vulnerability discovered by type5afe in WordPress Plugin SureForms versions = 1.13.1...

Resilient Distribution Network Planning against Dynamic Malicious Power Injection Attacks

Active distribution networks facilitating bidirectional power exchange with renewable energy resources are susceptible to cyberattacks due to integration of a diverse array of cyber components. This study introduces a grid-level defense strategy aimed at enhancing attack resiliency based on...

[SECURITY] [DSA 6059-1] thunderbird security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6059-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff November 16, 2025 https://www.debian.org/security/faq -...

CVE-2025-7736

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.9 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated attacker to bypass access control restrictions and view GitLab Pages content intended only for project members by...

CVE-2025-11990

GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated user to gain CSRF tokens by exploiting improper input validation in repository references combined with redirect handling weaknesses...

Decoupling Bias, Aligning Distributions: Synergistic Fairness Optimization for Deepfake Detection

Fairness is a core element in the trustworthy deployment of deepfake detection models, especially in the field of digital identity security. Biases in detection models toward different demographic groups, such as gender and race, may lead to systemic misjudgments, exacerbating the digital divide...

CVE-2025-11538: Binding to an Unrestricted IP Address

A vulnerability exists in Keycloak's server distribution where enabling debug mode --debug insecurely defaults to binding the Java Debug Wire Protocol JDWP port to all network interfaces 0.0.0.0. This exposes the debug port to the local network, allowing an attacker on the same network segment to...

Malicious code in anidta-hauli-mudisli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba2b3327ec00ffa5e14ba23007c0944039502098dd18fe0bbb60ae23b91474b1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-174428 Malicious code in goodai-sunabi-cufau (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 321e5c91c8ab17357dbd36b4344e391e5c564b533777b3de04f8a5404d110e1b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-131921

If kdcproxy receives a request for a realm which does not have server addresses defined in its configuration, by default, it will query SRV records in the DNS zone matching the requested realm name. This creates a server-side request forgery vulnerability, since an attacker could send a request f...

EUVD-2025-131919

If an attacker causes kdcproxy to connect to an attacker-controlled KDC server e.g. through server-side request forgery, they can exploit the fact that kdcproxy does not enforce bounds on TCP response length to conduct a denial-of-service attack. While receiving the KDC's response, kdcproxy copie...

Malicious code in pedromartins (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c1a221f40eb857b3c559160343fa97adc32a28b9952750fb6d78618a8370dd6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-30182

Uncontrolled search path for some IntelR Distribution for Python software installers before version 2025.2.0 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalati...

MAL-2025-163884 Malicious code in nusdtafr-msiuyu-muaivcascf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84d6a680cf404f3f731f307d1e2d525068b837a092c814fccba15b1c6c548f4f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-155961 Malicious code in ican-poke79 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59e7411cf4a268df43848d18631f3ce1fe0b413e2c506a59507641ad39a44930 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-59089

If an attacker causes kdcproxy to connect to an attacker-controlled KDC server e.g. through server-side request forgery, they can exploit the fact that kdcproxy does not enforce bounds on TCP response length to conduct a denial-of-service attack. While receiving the KDC's response, kdcproxy copie...

Malicious code in eslint-plugin-element-ui-hyperion-dagda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5038fe2a3c36f89c8648d1958ea6266b9e56a0ef60f2efb00d26435c3e79a2b9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-130019 Malicious code in sari-brongkos73-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bae65c66f97f0c4a2ba607a861499077f0a13c807113031c49843ecdc10c699 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in citra-nasi47-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b26316d8d883e0c5edd7cc50b4dfebb0e9232a66fb4b257c2877211ff81ba483 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-93497

Uncontrolled search path for some IntelR Distribution for Python software installers before version 2025.2.0 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalati...