5548 matches found
PT-2026-21934
Name of the Vulnerable Software and Affected Versions asbplayer version 1.13.0 Description An arbitrary file upload issue exists in the subtitle loading function. Successful exploitation allows attackers to execute arbitrary code by uploading a specially crafted subtitle file. Recommendations At...
LangChain.js 代码问题漏洞
LangChain.js is an open-source implementation of a context-aware reasoning application developed by LangChain. Versions of LangChain.js prior to 1.1.8 contained code vulnerabilities. These vulnerabilities stemmed from the RecursiveUrlLoader component, which allowed unauthorized access to...
CVE-2025-69771
Cross-Site Scripting XSS vulnerability in the subtitle loading function of the asbplayer Chrome Extension version 1.14.0 allows attackers to execute arbitrary JavaScript in the context of the active streaming platform via a crafted .srt subtitle file. Because the script executes within the...
CLSA-2026-1771956748 gimp: Fix of CVE-2025-15059
CVE-2025-15059: fix PSP file loader to validate channel types for grayscale images, preventing invalid memory access from incorrect offset computation...
CLSA-2026-1771956020 gimp: Fix of CVE-2025-15059
CVE-2025-15059: fix PSP file loader to validate channel types for grayscale images, preventing invalid memory access from incorrect offset computation...
Developer-targeting campaign using malicious Next.js repositories
Microsoft Defender Experts identified a coordinated developer-targeting campaign delivered through malicious repositories disguised as legitimate Next.js projects and technical assessment materials. Telemetry collected during this investigation indicates the activity aligns with a broader cluster...
Malicious Package
Overview locale-loader-pro is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
MAL-2026-963 Malicious code in locale-loader-pro (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cfe4223d443a4180a9c6113449817f38d1d72fcd6f2f4cb42525dcb391c82b5 The package locale-loader-pro was found to contain malicious code. Source: ghsa-malware...
Malicious code in locale-loader-pro (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cfe4223d443a4180a9c6113449817f38d1d72fcd6f2f4cb42525dcb391c82b5 The package locale-loader-pro was found to contain malicious code. Source: ghsa-malware...
ClickFix Campaign Abuses Compromised Sites to Deploy MIMICRAT Malware
Cybersecurity researchers have disclosed details of a new ClickFix campaign that abuses compromised legitimate sites to deliver a previously undocumented remote access trojan RAT called MIMICRAT aka AstarionRAT. "The campaign demonstrates a high level of operational sophistication: compromised...
Improper Control of Generation of Code ('Code Injection') in @tygo-van-den-hurk/slyde
Impact This is a remote code execution RCE vulnerability. Node.js automatically imports /.plugin.js,mjs files including those from nodemodules, so any malicious package with a .plugin.js file could execute arbitrary code when installed or required. All projects using this loading behavior are...
PT-2026-20786
Name of the Vulnerable Software and Affected Versions Slyde versions 0.0.4 and below Description Slyde is a program used to create animated presentations from XML. A remote code execution issue exists because Node.js automatically imports /.plugin.js,mjs files, including those from node modules...
CLSA-2026-1771331675 grub2: Fix of CVE-2025-61662
CVE-2025-61662: fix use-after-free in gettext/gettext due to unregistered gettext command on module unload...
Divide and conquer: how the new Keenadu backdoor exposed links between major Android botnets
In April 2025, we reported on a then-new iteration of the Triada backdoor that had compromised the firmware of counterfeit Android devices sold across major marketplaces. The malware was deployed to the system partitions and hooked into Zygote – the parent process for all Android apps – to infect...
CVE-2025-29949
Insufficient input parameter sanitization in AMD Secure Processor ASP Boot Loader legacy recovery mode only could allow an attacker to write out-of-bounds to corrupt Secure DRAM potentially resulting in denial of service...
CVE-2025-48515
Insufficient parameter sanitization in AMD Secure Processor ASP Boot Loader could allow an attacker with access to SPIROM upgrade to overwrite the memory, potentially resulting in arbitrary code execution...
Siemens SIMATIC S7-1500 Out-of-bounds Read (CVE-2025-39787)
In the Linux kernel, the following vulnerability has been resolved: soc: qcom: mdtloader: Ensure we don't read past the ELF header When the MDT loader is used in remoteproc, the ELF header is sanitized beforehand, but that's not necessary the case for other clients. Validate the size of the...
yandex_station_2_exploit
Загрузчик неподписанного кода для Yandex Station 2 Yandex Max...
CVE-2026-1356 Converter for Media – Optimize images | Convert WebP & AVIF <= 6.5.1 - Unauthenticated Server-Side Request Forgery via src
The Converter for Media – Optimize images | Convert WebP & AVIF plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.5.1 via the PassthruLoader::loadimagesource function. This makes it possible for unauthenticated attackers to make web requests...
PT-2026-7833
The Converter for Media – Optimize images | Convert WebP & AVIF plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.5.1 via the PassthruLoader::load image source function. This makes it possible for unauthenticated attackers to make web reques...