21224 matches found
MAL-2025-48432 Malicious code in company-browser-package (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7621dd08044aeaacb68745078c793611d91031eb9852f8f667f739d485efe939 The OpenSSF Package Analysis project identified 'company-browser-package' @ 99.9.10 npm as malicious. It is considered malicious because: - The...
Leveraging Code Cohesion Analysis to Identify Source Code Supply Chain Attacks
Supply chain attacks significantly threaten software security with malicious code injections within legitimate projects. Such attacks are very rare but may have a devastating impact. Detecting spurious code injections using automated tools is further complicated as it often requires deciphering t...
ROS-20251016-03
A vulnerability in the FirmwarePerformancePei.c component of the UEFI EDK2 open source development environment is related to the lack of division by zero check. Exploitation of the vulnerability could allow an attacker to cause a denial of service...
Mysterious Elephant: a growing threat
Introduction Mysterious Elephant is a highly active advanced persistent threat APT group that we at Kaspersky GReAT discovered in 2023. It has been consistently evolving and adapting its tactics, techniques, and procedures TTPs to stay under the radar. With a primary focus on targeting government...
Cisco’s various products have security vulnerabilities
Cisco IOS XE and Cisco Secure Firewall Threat Defense are both products of Cisco, Inc.Cisco IOS XE is an operating system. A single operating system for enterprise wired and wireless access, aggregation, core, and WAN, Cisco IOS XE reduces business and network complexity.Cisco Secure Firewall...
CVE-2025-62360
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.Prior to 3.5.1, a SQL Injection vulnerability was identified in the /html/funcionario/dependentedocumento.php endpoint, specifically in the iddependente parameter. This vulnerability allows attackers to...
Microsoft raises the bar: A smarter way to measure AI for cybersecurity
ExCyTIn-Bench is Microsoft’s newest open-source benchmarking tool designed to evaluate how well AI systems perform real-world cybersecurity investigations.1 It helps business leaders assess language models by simulating realistic cyberthreat scenarios and providing clear, actionable insights into...
Microsoft raises the bar: A smarter way to measure AI for cybersecurity
ExCyTIn-Bench is Microsoft’s newest open-source benchmarking tool designed to evaluate how well AI systems perform real-world cybersecurity investigations.1 It helps business leaders assess language models by simulating realistic cyberthreat scenarios and providing clear, actionable insights into...
Karakeep security vulnerabilities
karakeep is a self-hostable bookmarking application from the Karakeep App open source. A security vulnerability exists in karakeep versions v0.26.0 through v0.7.0, which stems from vulnerability to server-side request forgery attacks...
Centreon security vulnerabilities
Centreon is a set of open source system monitoring tools from France's Centreon. The product mainly provides monitoring functions for resources such as network, system and application programs. Centreon has a security vulnerability that can be exploited by attackers to execute arbitrary Web scrip...
Centreon security vulnerabilities
Centreon is a set of open source system monitoring tools from France's Centreon. The product mainly provides monitoring functions for resources such as network, system and application programs. Centreon suffers from a command injection vulnerability that stems from the application's failure to...
KLA89275 SUI vulnerability in Microsoft Open Source Software
A spoofing vulnerability was found in Microsoft Open Source Software. Malicious users can exploit this vulnerability to spoof user interface. Original advisories CVE-2025-59288 Exploitation Public exploits exist for this vulnerability. Related products Playwright CVE list CVE-2025-59288 high KB...
APSB25-94 : Security update available for Adobe Commerce
Adobe has released a security update for Adobe Commerce and Magento Open Source. This update resolves critical and important vulnerabilities. Successful exploitation could lead to security feature bypass, privilege escalation, and arbitrary code execution...
EUVD-2025-34095
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.0, a Reflected Cross-Site Scripting XSS vulnerability was identified in the /pet/profilepet.php?idpet= endpoint of the WeGIA application. This vulnerability allows attackers to inject...
Get Projects School Management System Access Control Vulnerability
Get Projects School Management System is an open source school management system software from Get Projects. An access control error vulnerability exists in Get Projects School Management System that stems from a lack of authentication and could lead to a remote attack...
PT-2025-41817
Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.5.1 Description WeGIA is a Web Manager for Institutions. A SQL Injection issue exists in the /html/funcionario/cadastro funcionario pessoa existente.php API endpoint, specifically affecting the cpf parameter. Successf...
PT-2025-41821
Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.5.1 Description WeGIA is a Web Manager for Institutions. A SQL Injection issue exists in the /html/funcionario/dependente documento.php API endpoint, specifically through the id dependente parameter. Successful...
Malicious code in analytics-data-collection-fe (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9c5655e480e57af4b115f0660b3e96f7412f5d95816cd49858611d28761ea501 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
SASER: Stego Attacks on Open-Source LLMs
Open-source large language models LLMs have demonstrated considerable dominance over proprietary LLMs in resolving neural processing tasks, thanks to the collaborative and sharing nature. Although full access to source codes, model parameters, and training data lays the groundwork for transparenc...