One Signature, Multiple Payments: Demystifying and Detecting Signature Replay Vulnerabilities in Smart Contracts

Smart contracts have significantly advanced blockchain technology, and digital signatures are crucial for reliable verification of contract authority. Through signature verification, smart contracts can ensure that signers possess the required permissions, thus enhancing security and scalability...

How Can We Effectively Use LLMs for Phishing Detection?: Evaluating the Effectiveness of Large Language Model-Based Phishing Detection Models

Large language models LLMs have emerged as a promising phishing detection mechanism, addressing the limitations of traditional deep learning-based detectors, including poor generalization to previously unseen websites and a lack of interpretability. However, LLMs' effectiveness for phishing...

Huawei EulerOS: Security Advisory for golang (EulerOS-SA-2025-2358)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WellSky Harmony 安全漏洞

WellSky Harmony is an all-in-one service management platform from WellSky USA. A security vulnerability exists in WellSky Harmony version 4.1.0.2.83, which stems from improper cleanup of the TXTUSERID parameter in the xmHarmony.asp endpoint, which could lead to an SQL injection attack...

PT-2025-46577

Name of the Vulnerable Software and Affected Versions ViewLead Technology Bacteriology Laboratory Reporting System affected versions not specified Description The Bacteriology Laboratory Reporting System allows unauthenticated remote attackers to inject arbitrary SQL commands, potentially enablin...

StyleBreak: Revealing Alignment Vulnerabilities in Large Audio-Language Models Via Style-Aware Audio Jailbreak

Large Audio-language Models LAMs have recently enabled powerful speech-based interactions by coupling audio encoders with Large Language Models LLMs. However, the security of LAMs under adversarial attacks remains underexplored, especially through audio jailbreaks that craft malicious audio promp...

CVE-2025-12434

Race in Storage in Google Chrome on Windows prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-59499

Improper neutralization of special elements used in an sql command 'sql injection' in SQL Server allows an authorized attacker to elevate privileges over a network...

EUVD-2025-84350

Zohocorp ManageEngine Analytics Plus versions 6170 and below are vulnerable to Unauthenticated SQL Injection due to the improper filter configuration...

CVE-2025-8324 SQL Injection

Zohocorp ManageEngine Analytics Plus versions 6170 and below are vulnerable to Unauthenticated SQL Injection due to the improper filter configuration...

grub2: grub-core/gettext: Integer overflow leads to Heap OOB Write.

A flaw was found in grub2. The calculation of the translation buffer when reading a language .mo file in grubgettextgetstrfromposition may overflow, leading to a Out-of-bound write. This issue can be leveraged by an attacker to overwrite grub2's sensitive heap data, eventually leading to the...

XPath Injection

smolagents is vulnerable to XPath injection. The vulnerability is due to insecure XPath construction due to searchitemctrlf concatenating unsanitized user input into XPath expressions, allowing attackers to inject XPath to bypass filters, access unintended DOM nodes, or disrupt web automation...

Malicious code in statutory_butterfly_0xrequest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 502c925004aa878e6d59d46196b59a53104016061225edd6eaf5d306a2d41701 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-97674 Malicious code in cockroach_blue-64-tisubasah (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2d88ce984e9b31308833bc84a862bf25070a219ac93d4280243e2839b3ef01c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-84643 Malicious code in dian-sate70-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0a91903928f46456e389578b0c21b16257878a493578e36e4fafb601e8c2e57 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-89737 Malicious code in putri-oncom20-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2492eeb168d915836c877df8eee5fe714ef452e3c02e3e00a0e769ef0fec331 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bambang-martabak65-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3514c8d58d850d3895d9c1137b40c9bb38f27a67669f01f992a5f71787fe9e01 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wibowo-tek1-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc9fccff2781eef88f2fe90ad97de4b974517d86521000e5c96ea3bc63ac92d0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-87048 Malicious code in joko-gaplek75-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 897f5a51defdf744199cabc567e55917e31653e92d867f822c3a0665e69611e6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in putri-oblok13-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff9bd7cd7b72922d2490a4fb6027282e52076325bbde485bb67eeececd4a0502 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...