Strengthening supply chain security: Preparing for the next malware campaign

The open source ecosystem continues to face organized, adaptive supply chain threats that spread through compromised credentials and malicious package lifecycle scripts. The most recent example is the multi-wave Shai-Hulud campaign. While individual incidents differ in their mechanics and speed,...

CVE-2025-14302

creationtimestamp| type| source ---|---|--- 2025-12-22 08:39:26+00:00| published-proof-of-concept| https://t.me/xakepru/18676...

CGA-R385-9H2C-MH3H

Bulletin has no description...

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception in the session establishment handler process. An attacker can cause the process to panic and terminate by sending a PFCP Session Establishment Request that omits the mandatory F-SEID CPF-SEID Information Element...

CVE-2025-67886

creationtimestamp| type| source ---|---|--- 2025-12-18 15:00:09+00:00| published-proof-of-concept| Telegram/7hKD5YeJK0RQiIJ3OrJi5geFO0owuRt0spxMlfyZ7RMSrKY 2026-05-08 08:55:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mldebbbbtx2t...

A First Look at Common RPKI Publication Practices

The RPKI is crucial for securing the routing system of the Internet. With the RPKI, owners of Internet resources can make cryptographically backed claims, for example about the legitimate origin of their IP space. Thousands of networks use this information to detect malicious or accidental route...

CVE-2025-68056

creationtimestamp| type| source ---|---|--- 2025-12-16 09:28:05+00:00| seen| https://gist.github.com/Darkcrai86/ff62587f4ff66b42e40fec0063f256fc...

What Happens Inside PDFAid in Seconds: From Upload to Download

Disclosure: This article was submitted by PDFAid for publication...

CVE-2024-58304

creationtimestamp| type| source ---|---|--- 2025-12-11 23:39:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m7qqnic5ze2o...

CVE-2025-49173

creationtimestamp| type| source ---|---|--- 2025-12-10 09:00:05+00:00| published-proof-of-concept| Telegram/b0MrL-7YyNVMwlRE8cQmf3aSFWZZuNk0ErN3GEJH-SnDaRk...

RUSTSEC-2025-0152 `finch_cli_rust` was removed from crates.io for malicious code

This attempts to typosquat the existing crate finchcli to steal credentials from local files. The malicious crate had 1 version published on 2025-12-08 and had been downloaded 18 times. There were no crates depending on this crate on crates.io. Thanks to Matthias Zepper of NGI Sweden for reportin...

Space Bears Ransomware Claims Comcast Data Theft Through Quasar Breach

Space Bears ransowmare claims it obtained Comcast files through a breach at Quasar Inc, with threats to publish the data and separate leaks promised from Quasar itself...

PT-2025-50294

CVE-2025-14271 - Rejected reason: This CVE ID has been withdrawn by CVE ID : CVE-2025-14271 Published : Dec. 8, 2025, 4:15 p.m. | 38 minutes ago Description : Rejected reason: This CVE ID has been withdrawn by its CVE Numbering Authority. Severity: 0.0 | NA Visit the link for more details, such a...

Cross-Site Request Forgery (CSRF)

com.liferay, com.liferay.change.tracking.web is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to insufficient request-validation mechanisms, which allows an attacker to trick users into unknowingly performing actions that add or edit publication comments...

CVE-2025-21072

creationtimestamp| type| source ---|---|--- 2025-12-02 02:54:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m6xwuw5sqn2k...

EUVD-2025-200091

SoftSea EPUB File Reader 1.0.0.0 is vulnerable to Directory Traversal. The vulnerability resides in the EPUB file processing component, specifically in the functionality responsible for extracting and handling EPUB archive contents...

PT-2025-48538

Name of the Vulnerable Software and Affected Versions SoftSea EPUB File Reader version 1.0.0.0 Description SoftSea EPUB File Reader version 1.0.0.0 contains a flaw related to directory traversal. This issue is present in the EPUB file processing component, specifically when handling and extractin...

CVE-2025-59534

creationtimestamp| type| source ---|---|--- 2025-11-28 15:27:35+00:00| published-proof-of-concept| https://t.me/cKure/15756...

PT-2025-48136

The Houzez theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.1.6 via deserialization of untrusted input in saved-search-item.php. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. No...

Malicious code in @voiceflow/api-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3e961a08f55ee9c09ea08f6e26ed609d489927fd347b2015b8c7a3074f6c439 The package @voiceflow/api-sdk was found to contain malicious code. Source: ghsa-malware...