Victoria’s Secret US Website Restored After Security Incident

Victoria's Secret website was down due to a 'security incident' impacting online and some in-store services. Get the…...

CVE-2025-48936 ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injection

Zitadel is open-source identity infrastructure software. Prior to versions 2.70.12, 2.71.10, and 3.2.2, a potential vulnerability exists in the password reset mechanism. ZITADEL utilizes the Forwarded or X-Forwarded-Host header from incoming requests to construct the URL for the password reset...

MAL-2025-4592 Malicious code in @bugbounty208/sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3880eb4b27327dd3c26a3000c1d1f720ec589fc10d0d490bc532874c0c1c9ed2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Hush! Protecting Secrets during Model Training: an Indistinguishability Approach

We consider the problem of secret protection, in which a business or organization wishes to train a model on their own data, while attempting to not leak secrets potentially contained in that data via the model. The standard method for training models to avoid memorization of secret information i...

Verifiable Weighted Secret Sharing

Traditionally, threshold secret sharing TSS schemes assume all parties have equal weight, yet emerging systems like blockchains reveal disparities in party trustworthiness, such as stake or reputation. Weighted Secret Sharing WSS addresses this by assigning varying weights to parties, ensuring...

The vulnerability of the Shamir’s secret platform implementation for archiving corporate information, HashiCorp Vault and Vault Enterprise, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the Shamir’s secret platform implementation for archiving corporate information, both HashiCorp Vault and Vault Enterprise, is related to insufficient protection of sensitive data. Exploiting this vulnerability could allow an intruder to gain unauthorized access to the...

Cromwell GitHub Actions Secrets exfiltration via `Issue_comment`

Summary Using Issuecomment on .github/workflows/scalafmt-fix.yml an attacker can inject malicious code using github.event.comment.body. By exploiting the vulnerability, it is possible to exfiltrate high privileged GITHUBTOKEN which can be used to completely overtake the repo since the token has...

MAL-2025-4535 Malicious code in wallet-connector-rce (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7da34a4136664074d4841726a150a99a3bc33e88c131fc32766950633e0f9558 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4530 Malicious code in ledger-transport (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc743e9a6f102ba2318706d8d0396d38233132640f0d11cffb7388e14bb6537b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of Siemens Scalance LPE9403 industrial switches’ microprogramming software, related to the transmission of secret information in the form of open text, allows a intruder to gain unauthorized access to the protected information.

The vulnerability of Siemens Scalance LPE9403 industrial switches’ microprogramming software relates to the transmission of secret information in the form of open text. Exploiting this vulnerability can allow an intruder to gain unauthorized access to the protected information...

Privacy-Preserving Prompt Personalization in Federated Learning for Multimodal Large Language Models

Prompt learning is a crucial technique for adapting pre-trained multimodal language models MLLMs to user tasks. Federated prompt personalization FPP is further developed to address data heterogeneity and local overfitting, however, it exposes personalized prompts - valuable intellectual assets - ...

GHSA-WJRH-HJ83-3WH7 Django-Select2 Vulnerable to Widget Instance Secret Cache Key Leaking

Impact Instances of HeavySelect2Mixin subclasses like the ModelSelect2MultipleWidget and ModelSelect2Widget can secret access tokens across requests. This can allow users to access restricted querysets and restricted data. Patches The problem has been patched in version 8.4.1 and all following...

Django-Select2 Vulnerable to Widget Instance Secret Cache Key Leaking

Impact Instances of HeavySelect2Mixin subclasses like the ModelSelect2MultipleWidget and ModelSelect2Widget can secret access tokens across requests. This can allow users to access restricted querysets and restricted data. Patches The problem has been patched in version 8.4.1 and all following...

DEBIAN-CVE-2025-48383

Django-Select2 is a Django integration for Select2. Prior to version 8.4.1, instances of HeavySelect2Mixin subclasses like the ModelSelect2MultipleWidget and ModelSelect2Widget can leak secret access tokens across requests. This can allow users to access restricted query sets and restricted data...

UBUNTU-CVE-2025-48383

Django-Select2 is a Django integration for Select2. Prior to version 8.4.1, instances of HeavySelect2Mixin subclasses like the ModelSelect2MultipleWidget and ModelSelect2Widget can leak secret access tokens across requests. This can allow users to access restricted query sets and restricted data...

CVE-2025-48383 Django-Select2 Vulnerable to Widget Instance Secret Cache Key Leaking

Django-Select2 is a Django integration for Select2. Prior to version 8.4.1, instances of HeavySelect2Mixin subclasses like the ModelSelect2MultipleWidget and ModelSelect2Widget can leak secret access tokens across requests. This can allow users to access restricted query sets and restricted data...

MAL-2025-4490 Malicious code in mirror-chat-ctf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05a80d5c1613fb9a0db9f6d2b95f12da296ef2ac3f58be607c601a87c73d840e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in athira-windows-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d29372690a56d28aaf32363029d85a2f0f5b5eddbe8a7a2bb62435171567b354 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in athira-darwin-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9761ce65bffc628fa1ab18f6c7c91bc02aab88a7b9760520d49fb690ab30389 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in skinnyvans-windows-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 40605e85e89ede7d84e01953d5f081b7c5712debaf12245bf3596d64b23ec377 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...