6840 matches found
EUVD-2025-15562
Malicious code in bioql PyPI...
EUVD-2025-27506
Malicious code in bioql PyPI...
EUVD-2022-51556
Malicious code in bioql PyPI...
EUVD-2021-8576
Malicious code in bioql PyPI...
EUVD-2024-53295
Malicious code in bioql PyPI...
EUVD-2024-51042
Malicious code in bioql PyPI...
NiceGUI 跨站脚本漏洞
NiceGUI is an easy-to-use, Python-based UI framework open-sourced by NiceGUI. A cross-site scripting vulnerability exists in NiceGUI 2.24.2 and earlier versions that stems from not enforcing HTML or JavaScript cleanup, which could lead to cross-site scripting attacks...
CVE-2025-61595 MANTRA tx gas limit is not enforced in send hooks
MANTRA is a purpose-built RWA Layer 1 Blockchain, capable of adherence to real world regulatory requirements. Versions 4.0.1 and below do not enforce the tx gas limit in its send hooks. Send hooks can spend more gas than what remains in tx, combined with recursive calls in the wasm contract,...
Operation Cronos and the Takedown of LockBit: A Cybersecurity Milestone
Running short on time but still want to stay in the know? Well, we’ve got you covered! We’ve condensed all the key takeaways into a handy audio summary. Introduction LockBit aka ABCD Ransomware, one of the most destructive ransomware groups in history, was dismantled in early 2024 through a...
CVE-2025-56449
A security vulnerability was identified in Obsidian Scheduler's REST API 5.0.0 thru 6.3.0. If an account is locked out due to not enrolling in MFA e.g. after the 7-day enforcement window, the REST API still allows the use of Basic Authentication to authenticate and perform administrative actions...
Sex offenders, terrorists, drug dealers, exposed in spyware breach
We've covered spyware and stalkerware leaks many times before, but we don't often see such exposure in software used by law enforcement. According to a report by Straight Arrow News SAN, the hacker “wikkid” said the intrusion against RemoteCOM was “one of the easiest” they’d ever carried out...
CVE-2025-56449
Obsidian Scheduler REST API 5.0.0–6.3.0 is affected. The root cause is that accounts locked out due to MFA enforcement can still authenticate via Basic Authentication for administrative actions, allowing creation of a new privileged user and bypassing MFA protections. The issue affects the REST A...
Avoid Using Programs Labeled unconfined_service_t
The purpose of setting the unconfinedservicet label for SELinux is to enable some third-party service processes not configured with SELinux policies to run without restrictions. By default, when systemd runs a third-party application whose label is bint or usrt generally located in directories su...
Police using drones to read your license plates, warns EFF
Police are using drones as flying automated license plate readers ALPRs, according to a report by the Electronic Frontier Foundation EFF. And where there is a market, a provider will jump in. Or was it the other way around this time? Flock Safety, for example, recently told a group of potential l...
Scammers are impersonating the FBI to steal your personal data
Been scammed? Hoping to report it to the FBI? Definitely do so, but be careful. Spoofed versions of the FBI's Internet Crime Complaint Center IC3 website are now circulating online, and they lead straight back to the scammers. The FBI issued an advisory last week, warning that cybercriminals are...
Dark Web Roast - August 2025 Edition
Dark Web Roast - August 2025 Edition By Trellix Advanced Research Center · September 18, 2025 Executive Summary August 2025 delivered a masterclass in cybercriminal incompetence that would make amateur hour look professional. From racist social engineering recruiters who prioritize race over actu...
Unspecified vulnerability in Apple macOS Tahoe (CNVD-2025-22390)
Apple macOS Tahoe is the 26th major release of Apple's macOS operating system, which was released on June 10, 2025, and features a new "Liquid Glass" visual design that significantly optimizes interface aesthetics, feature integration, and cross-device collaboration. The 26th major version of the...
CVE-2025-59270
The CVE-2025-59270 entry concerns the psPAS PowerShell module (Get-PASSAMLResponse) not explicitly enforcing TLS 1.2 during SAML authentication. The root cause is insufficient TLS protocol enforcement, enabling a MITM adversary in the handshake to downgrade TLS to a deprecated version. The vulner...
Improper Access Control
unopim/unopim is vulnerable to Improper Access Control. The vulnerability is due to insufficient privilege enforcement on the mass-delete endpoint, which allows an attacker without "Delete" permissions to bypass restrictions and delete products...
