4799 matches found
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2025-61757link is external Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability This type of vulnerability is a frequent attack...
Future-Back Threat Modeling: A Foresight-Driven Security Framework
Traditional threat modeling remains reactive-focused on known TTPs and past incident data, while threat prediction and forecasting frameworks are often disconnected from operational or architectural artifacts. This creates a fundamental weakness: the most serious cyber threats often do not arise...
TencentOS Server 4: corosync (TSSA-2025:0287)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0287 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2025-13223link is external Google Chromium V8 Type Confusion Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and...
CVE-2025-11446: Insertion of Sensitive Information into Log File
Insertion of Sensitive Information into Log File vulnerability in upKeeper Solutions upKeeper Manager allows Use of Known Domain Credentials.This issue affects upKeeper Manager: from 5.2.0 before 5.2.12...
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2025-58034link is external Fortinet FortiWeb OS Command Code Injection Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber...
PT-2025-47087
Name of the Vulnerable Software and Affected Versions WeiYe-Jing datax-web versions up to 2.1.2 Description A flaw exists in WeiYe-Jing datax-web that can lead to SQL injection. The issue is present in an unknown function and may be exploited remotely by executing manipulation. The exploit has be...
@apollo/gateway (>=2.12.0-preview.0, <=2.12.0), @lenne.tech/nest-server (>=11.3.0, <=11.5.0) potentially affected by unknown CVE via @apollo/composition (2.12.0-preview.4)
@apollo/composition NPM version 2.12.0-preview.4 is affected by a known vulnerability. The following packages have a transitive dependency on @apollo/composition and may be impacted: - @apollo/gateway =2.12.0-preview.0, =11.3.0, =11.5.0 Source cves: unknown CVE Source advisory:...
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2025-64446link is external Fortinet FortiWeb Path Traversal Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and...
Finding Software Supply Chain Attack Paths with Logical Attack Graphs
Cyberattacks are becoming increasingly frequent and sophisticated, often exploiting the software supply chain SSC as an attack vector. Attack graphs provide a detailed representation of the sequence of events and vulnerabilities that could lead to a successful security breach in a system. MulVal ...
PT-2025-47018
Name of the Vulnerable Software and Affected Versions Positive Technologies MaxPatrol 8 affected versions not specified Positive Technologies XSpider affected versions not specified Description The client communication service, listening on TCP port 2002, is susceptible to a remote...
org.webjars.npm:vega-embed (6.21.0) potentially affected by CVE-2025-59840 via org.webjars.npm:vega-interpreter (1.0.4)
org.webjars.npm:vega-interpreter MAVEN version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:vega-interpreter and may be impacted: - org.webjars.npm:vega-embed 6.21.0 Source cves: CVE-2025-59840 Source advisory:...
EUVD-2025-50819
Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input via CPU...
PT-2025-46873
Name of the Vulnerable Software and Affected Versions HP LaserJet Pro printers affected versions not specified Description Certain HP LaserJet Pro printers may be susceptible to information disclosure, potentially exposing credentials. This can occur by altering the scan/send destination address...
siddheshtea (1.1.6) potentially affected by unknown CVE via ruji-28 (1.0.0)
ruji-28 NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ruji-28 and may be impacted: - siddheshtea 1.1.6 Source cves: unknown CVE Source advisory: OSV:MAL-2025-165253...
Malicious code in known-green-loon (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3ea21280e0ddb21957b7e41e5deb88d67447b8bbea9ad0752123e40a897d3dd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-117276
Malicious code in known-green-loon npm...
Malicious code in known_leech_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36f36f9a18025bb5552abe1ee320024459cbaca19b607f3e75b115f2b9f201fd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in known_mandrill_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 295b082271888d9bb504a5eaf4d500aabc4d056cd79d69afc1dae875d183178d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...