CVE-2025-9391

Vulnerability CVE-2025-9391 affects Bjskzy Zhiyou ERP (versions up to 11.x). The flaw is in com.artery.workflow.ServiceImpl.getFieldValue, where improper handling of the sql argument enables SQL injection. Exploitation can be remote and publicly available PoCs are reported. Affected products and ...

FUJIFILM Healthcare Americas Synapse Mobility

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to access information beyond their assigned roles. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network...

IPIGuard: a Novel Tool Dependency Graph-Based Defense against Indirect Prompt Injection in LLM Agents

Large language model LLM agents are widely deployed in real-world applications, where they leverage tools to retrieve and manipulate external data for complex tasks. However, when interacting with untrusted data sources e.g., fetching information from public websites, tool responses may contain...

From Impact to Action: Turning BIA Insights Into Resilient Recovery

Modern businesses face a rapidly evolving and expanding threat landscape, but what does this mean for your business? It means a growing number of risks, along with an increase in their frequency, variety, complexity, severity, and potential business impact. The real question is, "How do you tackl...

Linux Distros Unpatched Vulnerability : CVE-2025-52897

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI is a Free Asset and IT Management Software package. In versions 9.1.0 through 10.0.18, an unauthenticated user can send a malicious link to attempt a...

Malicious code in create-planning-file-from-airtable (npm)

The package create-planning-file-from-airtable was found to contain malicious code...

Malicious code in planning-file-updater (npm)

The package planning-file-updater was found to contain malicious code...

Malicious code in get-stats-from-planning-file (npm)

The package get-stats-from-planning-file was found to contain malicious code...

MAL-2025-21366 Malicious code in get-stats-from-planning-file (npm)

The package get-stats-from-planning-file was found to contain malicious code...

MAL-2025-17662 Malicious code in create-planning-file-from-airtable (npm)

The package create-planning-file-from-airtable was found to contain malicious code...

MAL-2025-29372 Malicious code in planning-file-updater (npm)

The package planning-file-updater was found to contain malicious code...

Security Bulletin: IBM Planning Analytics is vulnerable to a Denial of Service due to the use of Apache Commons

Summary There is a vulnerability in one of the Open Source Software OSS components consumed by IBM Planning Analytics. This Security Bulletin relates only to the direct usage of third-party components by IBM Planning Analytics Workspace and not any nested dependencies within the product...

CVE-2025-52800 WordPress The E-Commerce ERP <= 2.1.1.3 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Unity Business Technology Pty Ltd The E-Commerce ERP profitori allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects The E-Commerce ERP: from n/a through = 2.1.1.3...

CVE-2025-52800

CVE-2025-52800: The E-Commerce ERP WordPress plugin (Unity Business Technology Pty) has a Missing Authorization flaw in ACLs for versions n/a through 2.1.1.3. Exploitation details are not provided in the documents, but remediation is to update The E-Commerce ERP to a version later than 2.1.1.3.

CVE-2025-42957

CVE-2025-42957 affects SAP S/4HANA with a vulnerability in a function module exposed via RFC that allows an authenticated user to inject arbitrary ABAP code, bypassing authorization checks and potentially taking full control of the SAP environment. The flaw can impact confidentiality, integrity, ...

CVE-2025-55077

Tyler Technologies ERP Pro 9 SaaS allows an authenticated user to escape the application and execute limited operating system commands within the remote Microsoft Windows environment with the privileges of the authenticated user. Tyler Technologies deployed hardened remote Windows environment...

Leak Reveals the Workaday Lives of North Korean IT Scammers

Spreadsheets, Slack messages, and files linked to an alleged group of North Korean IT workers expose their meticulous job-planning and targeting—and the constant surveillance they're under...

CVE-2025-55077 Tyler Technologies ERP Pro 9 SaaS application escape

Tyler Technologies ERP Pro 9 SaaS allows an authenticated user to escape the application and execute limited operating system commands within the remote Microsoft Windows environment with the privileges of the authenticated user. Tyler Technologies deployed hardened remote Windows environment...

Incident Response Planning Using a Lightweight Large Language Model with Reduced Hallucination

Timely and effective incident response is key to managing the growing frequency of cyberattacks. However, identifying the right response actions for complex systems is a major technical challenge. A promising approach to mitigate this challenge is to use the security knowledge embedded in large...

Large Reasoning Models Are Autonomous Jailbreak Agents

Jailbreaking -- bypassing built-in safety mechanisms in AI models -- has traditionally required complex technical procedures or specialized human expertise. In this study, we show that the persuasive capabilities of large reasoning models LRMs simplify and scale jailbreaking, converting it into a...