MAL-2025-6231 Malicious code in bufbuild-core (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ea2a6d8f75509bff2876bce466f00b9c7c810394f46e6479c6e2d8b19acc9557 The OpenSSF Package Analysis project identified 'bufbuild-core' @ 1.0...

CVE-2025-53537

creationtimestamp| type| source ---|---|--- 2025-07-24 00:53:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3luod2qveql2i 2025-10-10 06:46:36+00:00| seen| https://gist.github.com/Darkcrai86/7a8a46ebe032f3a5b6dc4800f88e9437...

Exploit for Type Confusion in Google Chrome

CVE-2024-4947 A in-the-wild V8 type confusion bug. This repo...

Privacy-Preserving Drone Navigation through Homomorphic Encryption for Collision Avoidance

As drones increasingly deliver packages in neighborhoods, concerns about collisions arise. One solution is to share flight paths within a specific zip code, but this compromises business privacy by revealing delivery routes. For example, it could disclose which stores send packages to certain...

MAL-2025-6009 Malicious code in protolab (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 395ceb17d3bf331597e101e685532b4af1d732b5ee31005221b0fcae61b97632 The OpenSSF Package Analysis project identified 'protolab' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MalCodeAI: Autonomous Vulnerability Detection and Remediation Via Language Agnostic Code Reasoning

The growing complexity of cyber threats and the limitations of traditional vulnerability detection tools necessitate novel approaches for securing software systems. We introduce MalCodeAI, a language-agnostic, multi-stage AI pipeline for autonomous code security analysis and remediation. MalCodeA...

CVE-2025-7465

creationtimestamp| type| source ---|---|--- 2025-07-12 07:51:32+00:00| seen| https://bsky.app/profile/potato.software/post/3ltqusyguui2b...

When Developer Aid Becomes Security Debt: a Systematic Analysis of Insecure Behaviors in LLM Coding Agents

LLM-based coding agents are rapidly being deployed in software development, yet their security implications remain poorly understood. These agents, while capable of accelerating software development, may inadvertently introduce insecure practices. We conducted the first systematic security...

Cockpit Detection

Binary data cockpitdetect.nbin...

CVE-2025-38215

In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix doregisterframebuffer to prevent null-ptr-deref in fbvideomodetovar If fbaddvideomode in doregisterframebuffer fails to allocate memory for fbvideomode, it will later lead to a null-ptr dereference in fbvideomodetovar,...

Huawei EulerOS: Security Advisory for libsoup (EulerOS-SA-2025-1707)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft FrontPage Server Extensions (FPSE) Detection (HTTP)

HTTP based detection of Microsoft FrontPage Server Extensions FPSE. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

GHSA-FV92-FJC5-JJ9H vulnerabilities

Vulnerabilities for packages: kubecolor, terraform-mcp-server, opa-envoy, dagger, golangci-lint, nri-discovery-kubernetes, ko, gcsfuse, cloud-sql-proxy, tekton-chains, cosign, neuvector-sigstore-interface, kor, splunk-otel-collector, k9s, filebrowser, atlantis, kots, traefik, harbor-cli, opentofu...

MAL-2025-5278 Malicious code in codesandbox-deps (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a8cbaaee48ac510c9d11bc481194ff5a4006d0233d8d2d06a3422628cea6a879 Any computer that has this package installed or running should be considered...

MAL-2025-5251 Malicious code in aws-sdk-react-native-core (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 626365c8daf9243d0d8281fa741a8537d284b73f873547122f9bdab75513d280 Any computer that has this package installed or running should be considered...

Medium: amazon-cloudwatch-agent

Issue Overview: The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result i...

Privacy-Preserving Federated Learning against Malicious Clients Based on Verifiable Functional Encryption

Federated learning is a promising distributed learning paradigm that enables collaborative model training without exposing local client data, thereby protect data privacy. However, it also brings new threats and challenges. The advancement of model inversion attacks has rendered the plaintext...

Building Automotive Security on Internet Standards: an Integration of DNSSEC, DANE, and DANCE to Authenticate and Authorize In-Car Services

The automotive industry is undergoing a software-as-a-service transformation that enables software-defined functions and post-sale updates via cloud and vehicle-to-everything communication. Connectivity in cars introduces significant security challenges, as remote attacks on vehicles have become...

Towards Effective Complementary Security Analysis Using Large Language Models

A key challenge in security analysis is the manual evaluation of potential security weaknesses generated by static application security testing SAST tools. Numerous false positives FPs in these reports reduce the effectiveness of security analysis. We propose using Large Language Models LLMs to...

Malicious code in taskcluster-db (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 015560a72e308c3ba1770533176ac7fe0bcfbe4892581829992ee47063774f5c Any computer that has this package installed or running should be considered...