IncusOS has a LUKS encryption bypass due to insufficient TPM policy

The default configuration of systemd-cryptenroll as used by IncusOS through mkosi allows for an attacker with physical access to the machine to access the encrypted data without requiring any interaction by the system's owner or any tampering of Secure Boot state or kernel UKI boot image. That's...

CVE-2025-59785

CVE-2025-59785 affects 2N Access Commander, with affected versions prior to 3.4.3. The root cause is improper validation of an API endpoint in the product, which can allow bypassing the password policy used for backup file encryption. Exploitation requires administrator privileges (authenticated ...

neopythonlogger

chrome-privless-encryption A PoC demonstrating how to bypass...

CVE-2025-62002

BullWall Ransomware Containment relies on the number of file modifications to trigger detection. An authenticated attacker could encrypt a single large file without triggering a detection alert. Versions 4.6.0.0, 4.6.0.6, 4.6.0.7, and 4.6.1.4 were confirmed to be affected; other versions before a...

burp_mirror_gui

Burp Multiple Instance Management Tool This solution, when combined with jsforward or mitmdump, effectively addresses the following pain points in penetration testing: 1. Enables real-time testing for privilege escalation, unauthorized access, business logic vulnerabilities, and session-related...

New Sturnus Android Malware Reads WhatsApp, Telegram, Signal Chats via Accessibility Abuse

Sturnus, an advanced Android banking trojan, has been discovered by ThreatFabric. Learn how this malware bypasses end-to-end encryption on Signal and WhatsApp, steals bank credentials using fake screens, and executes fraudulent transactions...

GHSA-R9X7-7GGJ-FX9F PrivateBin vulnerable to malicious filename use for self-XSS / HTML injection locally for users

Summary Dragging a file whose filename contains HTML is reflected verbatim into the page via the drag-and-drop helper, so any user who drops a crafted file on PrivateBin will execute arbitrary JavaScript within their own session self-XSS. This allows an attacker who can entice a victim to drag or...

CVE-2025-64711

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Starting in version 1.7.7 and prior to version 2.0.3, dragging a file whose filename contains HTML is reflected verbatim into the page via the drag-and-drop helper, so any user who drops a crafted file on...

EUVD-2017-0176

Malware in sbrugna...

EUVD-2017-18484

Malware in sbrugna...

EUVD-2020-4939

Malware in sbrugna...

EUVD-2017-5389

Malware in sbrugna...

EUVD-2019-0116

Malware in sbrugna...

EUVD-2009-3183

Malware in sbrugna...

EUVD-2016-1755

Malware in sbrugna...

EUVD-2021-33542

Malicious code in bioql PyPI...

EUVD-2022-52514

Malicious code in bioql PyPI...

PT-2025-39230

Yes, Zoho has faced several security issues: - 2021: ManageEngine ADSelfService Plus vulnerability CVE-2021-40539 exploited by APT27, affecting 9+ organizations and 11,000+ servers with Godzilla Webshell malware. Patched by Zoho. - 2022: Critical RCE flaw in ManageEngine led to BankingLab breach,...

Linux Distros Unpatched Vulnerability : CVE-2019-0223

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 C library and its language bindings c...

CVE-2025-7020 BYD DiLink OS Incorrect encryption Implementation of system log dumps

An incorrect encryption implementation vulnerability exists in the system log dump feature of BYD's DiLink 3.0 OS e.g. in the model ATTO3. An attacker with physical access to the vehicle can bypass the encryption of log dumps on the In-Vehicle Infotainment IVI unit's storage. This allows the...