New Cloud Vulnerability Data Shows Google Cloud Leads in Risk

New research shows Google Cloud and smaller providers have the highest cloud vulnerability rates as compared to AWS…...

April 22, 2025—KB5055629 (OS Builds 22621.5262 and 22631.5262) Preview

None None...

[SECURITY] Fedora 41 Update: rust-icu_provider_macros-1.5.0-1.fc41

Proc macros for ICU data providers...

[SECURITY] Fedora 40 Update: rust-icu_provider_macros-1.5.0-1.fc40

Proc macros for ICU data providers...

[SECURITY] Fedora 42 Update: rust-icu_provider_macros-1.5.0-1.fc42

Proc macros for ICU data providers...

PoisonSeed Exploits CRM Accounts to Launch Cryptocurrency Seed Phrase Poisoning Attacks

A malicious campaign dubbed PoisonSeed is leveraging compromised credentials associated with customer relationship management CRM tools and bulk email providers to send spam messages containing cryptocurrency seed phrases in an attempt to drain victims' digital wallets. "Recipients of the bulk sp...

SQL Injection

apacheairflowprovidersmysql is vulnerable to SQL Injection. The vulnerability is due to insufficient input validation and improper sanitization of user-supplied input in the dumpsql and loadsql functions, allowing attackers to inject and execute unintended SQL commands...

CVE-2025-30204 vulnerabilities

Vulnerabilities for packages: sftpgo-plugin-kms, gitness, mc-fips, step-fips, glab, kyverno-notation-aws, jitsucom-bulker, kyverno-policy-reporter-ui, gitea-fips, harbor-fips, opencost-fips, chezmoi, trufflehog-fips, cosign, tekton-chains-fips, tkn-fips, kube-metrics-adapter, atlantis-fips,...

Why Continuous Compliance Monitoring Is Essential For IT Managed Service Providers

Regulatory compliance is no longer just a concern for large enterprises. Small and mid-sized businesses SMBs are increasingly subject to strict data protection and security regulations, such as HIPAA, PCI-DSS, CMMC, GDPR, and the FTC Safeguards Rule. However, many SMBs struggle to maintain...

Malicious code in @theoretical123/providers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e1ac0be55c85d10a80061be96a98fee35155a4a24297d95b281f4ce8226b42a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Overview Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere due to the improper validation of target registry domains during the token exchange process. An attacker can extract and misuse authentication tokens by directin...

Citrix - CSP Monthly Consumption licenses EOL

On 01-Mar-2025, Citrix Service Providers running License Server v11.17.2 build 51000 with a combination of certain types of licenses were unable to launch end user sessions. The impacted licenses were associated with a discontinued licensing offering. There were some cases where partners on the n...

How Payment Orchestration Enhances Business Efficiency

Payment Orchestration Platforms streamline transactions by routing payments through multiple providers, reducing costs, boosting approval rates, and enhancing…...

DORA: Strengthening Digital Resilience Through API Security

The Digital Operational Resilience Act DORA is one of the most significant cybersecurity regulations for financial institutions in the European Union EU. Failure to comply can have massive consequences, including financial penalties and forced operational downtime, meaning achieving DORA complian...

The Ultimate MSP Guide to Structuring and Selling vCISO Services

The growing demand for cybersecurity and compliance services presents a great opportunity for Managed Service Providers MSPs and Managed Security Service Providers MSSPs to offer virtual Chief Information Security Officer vCISO services—delivering high-level cybersecurity leadership without the...

CVE-2025-25203 Ctrlpanel has stored XSS vulnerability in TicketsController priority field

CtrlPanel is open-source billing software for hosting providers. Prior to version 1.0, a Cross-Site Scripting XSS vulnerability exists in the TicketsController and Moderation/TicketsController due to insufficient input validation on the priority field during ticket creation and unsafe rendering o...

GHSA-2HJH-495W-HMXC Withdrawn Advisory: Sylius allows unrestricted brute-force attacks on user accounts

Withdrawn Advisory This advisory has been withdrawn because it is not a vulnerability in the Sylius framework. This link is maintained to preserve external references. Original Description A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks ...

4 Reasons Why MSPs & MSSPs Need to Enhance Attack Surface Management

In today’s rapidly evolving digital landscape, Managed Service Providers MSPs and Managed Security Service Providers MSSPs face increasing challenges. As businesses expand their digital footprints, MSPs and MSSPs are under pressure to deliver comprehensive security services while managing costs,...

CVE-2017-11428

OneLogin Ruby-SAML 1.6.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication...

Infrastructure Laundering: Blending in with the Cloud

Image: Shutterstock, ArtHead. In an effort to blend in and make their malicious traffic tougher to block, hosting firms catering to cybercriminals in China and Russia increasingly are funneling their operations through major U.S. cloud providers. Research published this week on one such outfit --...