1inch Named Exclusive Swap Provider at Launch for Ledger Multisig

Road Town, British Virgin Islands, 11th December 2025, CyberNewsWire...

com.flowdock.jenkins:jenkins-flowdock-plugin (>=1.0, <=1.0.2), net.praqma:drmemory-plugin (>=1.0, <=1.3) +8 more potentially affected by CVE-2025-67637 via org.jenkins-ci.main:jenkins-core (1.454)

org.jenkins-ci.main:jenkins-core MAVEN version 1.454 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.flowdock.jenkins:jenkins-flowdock-plugin =1.0, =1.0, =1.2, =0.5, =0.6.1 Source cves:...

net.praqma:monkit-plugin (>=0.2.5, <=1.0.0), org.jenkins-ci.main:jenkins-test-harness (1.426) +7 more potentially affected by CVE-2025-67637 via org.jenkins-ci.main:jenkins-core (1.426)

org.jenkins-ci.main:jenkins-core MAVEN version 1.426 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - net.praqma:monkit-plugin =0.2.5, =0.1, =1.0, =1.3 Source cves: CVE-2025-67637 Source advisory:...

com.flowdock.jenkins:jenkins-flowdock-plugin (>=1.0, <=1.0.2), net.praqma:drmemory-plugin (>=1.0, <=1.3) +8 more potentially affected by CVE-2025-67635 via org.jenkins-ci.main:jenkins-core (1.454)

org.jenkins-ci.main:jenkins-core MAVEN version 1.454 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.flowdock.jenkins:jenkins-flowdock-plugin =1.0, =1.0, =1.2, =0.5, =0.6.1 Source cves:...

org.jenkins-ci.main:jenkins-test-harness (1.491), org.jenkins-ci.main:jenkins-war (1.491) +6 more potentially affected by CVE-2025-67635 via org.jenkins-ci.main:jenkins-core (1.491)

org.jenkins-ci.main:jenkins-core MAVEN version 1.491 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.491 - org.jenkins-ci.main:jenkins-war 1.491 -...

com.flowdock.jenkins:jenkins-flowdock-plugin (>=1.0, <=1.0.2), net.praqma:drmemory-plugin (>=1.0, <=1.3) +8 more potentially affected by CVE-2025-67638 via org.jenkins-ci.main:jenkins-core (1.454)

org.jenkins-ci.main:jenkins-core MAVEN version 1.454 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.flowdock.jenkins:jenkins-flowdock-plugin =1.0, =1.0, =1.2, =0.5, =0.6.1 Source cves:...

de.adorsys.keycloak:user-secret-adapter-embedded (1.0.7), de.adorsys.keycloak:user-secret-auth-provider (1.0.7) +12 more potentially affected by CVE-2025-14082 via org.keycloak:keycloak-services (7.0.0)

org.keycloak:keycloak-services MAVEN version 7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.keycloak:user-secret-adapter-embedded 1.0.7 -...

com.charlyghislain.keycloak:keycloak-importexport (>=11.0.1, <=11.0.2), fr.cnieg.keycloak:attribute-login-provider (>=1.1.0, <=1.2.4) +9 more potentially affected by CVE-2025-14082 via org.keycloak:keycloak-services (11.0.2)

org.keycloak:keycloak-services MAVEN version 11.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.charlyghislain.keycloak:keycloak-importexport =11.0.1, =1.1.0, =1.2.4 -...

de.adorsys.sts:keycloak-storage-provider (0.29.0), dk.grinn.keycloak:keycloak-migrate-resource (0.0.5) +10 more potentially affected by CVE-2025-14082 via org.keycloak:keycloak-services (5.0.0)

org.keycloak:keycloak-services MAVEN version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.sts:keycloak-storage-provider 0.29.0 - dk.grinn.keycloak:keycloak-migrate-resource 0.0.5...

de.adorsys.multibanking:keycloak-custom-secret-provider (>=1.3.0, <=1.20), org.keycloak:keycloak-authz-policy-drools (3.1.0.final) +5 more potentially affected by CVE-2025-14082 via org.keycloak:keycloak-services (3.1.0.final)

org.keycloak:keycloak-services MAVEN version 3.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.multibanking:keycloak-custom-secret-provider =1.3.0, =1.20 -...

Malicious Package

Overview datadog-checks-dependency-provider is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious code in datadog-checks-dependency-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 965b1dfdded3e786f1691c392462534c6a7dc105aa989d08e68ff1b6c9f78bc7 The package datadog-checks-dependency-provider was found to contain malicious code. Source: ghsa-malware...

MAL-2025-192406 Malicious code in datadog-checks-dependency-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 965b1dfdded3e786f1691c392462534c6a7dc105aa989d08e68ff1b6c9f78bc7 The package datadog-checks-dependency-provider was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-202371

Malicious code in datadog-checks-dependency-provider npm...

Google Android Permission Obfuscation Vulnerability

Google Android is a free and open source mobile operating system based on the Linux kernel developed by Google. Google Android suffers from a privilege obfuscation vulnerability that originates from a privilege obfuscation issue in the SettingsSliceProvider.java file, which can be exploited by an...

CVE-2025-48608

In isValidMediaUri of SettingsProvider.java, there is a possible cross user media read due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

Babylon Incorrect FP inactive accounting in costaking creates “phantom stake” that earns rewards after BTC unbond

Summary A state consistency bug in x/costaking can leave a BTC delegator with non-zero ActiveSatoshis Phatom Stake even after they have fully unbonded their BTC delegation, if their Finality Provider FP drops out of the active set in the exact same babylon block height. This creates a “phantom...

GHSA-4RMQ-MC2C-R495 Babylon Incorrect FP inactive accounting in costaking creates “phantom stake” that earns rewards after BTC unbond

Summary A state consistency bug in x/costaking can leave a BTC delegator with non-zero ActiveSatoshis Phatom Stake even after they have fully unbonded their BTC delegation, if their Finality Provider FP drops out of the active set in the exact same babylon block height. This creates a “phantom...

Incomplete Cleanup

Overview Affected versions of this package are vulnerable to Incomplete Cleanup in the x/costaking process. An attacker can continue to accrue rewards without maintaining any actual BTC stake by exploiting a state inconsistency that occurs when a Finality Provider becomes inactive at the same blo...

EUVD-2025-201730

Traefik is an HTTP reverse proxy and load balancer. Versions 3.5.0 through 3.6.2 have inverted TLS verification logic in the nginx.ingress.kubernetes.io/proxy-ssl-verify annotation. Setting the annotation to "on" intending to enable backend TLS certificate verification actually disables...