CVE-2025-52992

The Nix, Lix, and Guix package managers fail to properly set permissions when a derivation build fails. This may allow arbitrary processes to modify the content of a store outside of the build sandbox. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and...

PT-2025-27160 · WordPress · Wp Edit

Name of the Vulnerable Software and Affected Versions: WP Edit versions 4.0.4 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject malicious...

MAL-2025-6596 Malicious code in sqiul83 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 67d309c2d4c740426c07cc17768f6313eebd765242e7e4a63aa04213d21358ea During installation of the source package, it attempts to silently download and start a remote executable. At the time of analysis, the downloading link did no...

MAL-2025-5450 Malicious code in phantom-sign-in-with-solana (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6fb04ee07048a7f2aa9201a7f29e3d8bb5802fb53f095bc48f93928568cf4646 Any computer that has this package installed or running should be considered...

CVE-2025-52903 File Browser Allows Execution of Shell Commands That Can Spawn Other Commands

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions on the 2.x branch prior to 2.33.10, the Command Execution feature of File Browser only allows the execution of shell command which have be...

Ubuntu 22.04 LTS : Linux kernel (Xilinx ZynqMP) vulnerabilities (USN-7602-1)

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7602-1 advisory. Michael Randrianantenaina discovered that the Bluetooth driver in the Linux Kernel contained an improper access control vulnerability. A nearby attacker...

CVE-2025-52889

Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus version 6.12 and 6.13 generates nftables rules for local services DHCP, DNS... that partially bypass security options security.macfiltering, security.ipv4filtering and...

CVE-2025-39202

creationtimestamp| type| source ---|---|--- 2025-06-24 13:50:52+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/19338 2025-07-03 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-184-02...

A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasures

In recent years, Large-Language-Model-driven AI agents have exhibited unprecedented intelligence, flexibility, and adaptability, and are rapidly changing human production and lifestyle. Nowadays, agents are undergoing a new round of evolution. They no longer act as an isolated island like LLMs...

MAL-2025-5229 Malicious code in k00h (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e8611181e62dbbb17a96abd393d71602a8ab52b9197629fe1d8724413c128de0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-26782

Name of the Vulnerable Software and Affected Versions: Claude Code for VSCode IDE extensions versions 0.2.116 through 1.0.23 Claude Code beta for JetBrains IDE plugins versions 0.1.1 through 0.1.8 Description: The issue allows unauthorized websocket connections from an attacker when visiting...

LLMs on Support of Privacy and Security of Mobile Apps: State of the Art and Research Directions

Modern life has witnessed the explosion of mobile devices. However, besides the valuable features that bring convenience to end users, security and privacy risks still threaten users of mobile apps. The increasing sophistication of these threats in recent years has underscored the need for more...

Exploiting AI for Attacks: on the Interplay between Adversarial AI and Offensive AI

As Artificial Intelligence AI continues to evolve, it has transitioned from a research-focused discipline to a widely adopted technology, enabling intelligent solutions across various sectors. In security, AI's role in strengthening organizational resilience has been studied for over two decades...

CVE-2025-52923

Sangfor aTrust (≤ 2.4.10) vulnerable: an issue allows users to modify the ExecStartPre command, indicating potential unaudited startup behavior and configuration modification. Affected product: Sangfor aTrust; affected component/command: ExecStartPre; root cause: insufficient protection around st...

Position: Certified Robustness Does Not (Yet) Imply Model Security

While certified robustness is widely promoted as a solution to adversarial examples in Artificial Intelligence systems, significant challenges remain before these techniques can be meaningfully deployed in real-world applications. We identify critical gaps in current research, including the parad...

CVE-2025-34022

A path traversal vulnerability exists in multiple models of Selea Targa IP OCR-ANPR cameras, including iZero, Targa 512, Targa 504, Targa Semplice, Targa 704 TKM, Targa 805, Targa 710 INOX, Targa 750, and Targa 704 ILB. The /common/getfile.php script in the “Download Archive in Storage” page fail...

PT-2025-26279 · WordPress · Custom Post Carousels With Owl

Name of the Vulnerable Software and Affected Versions: Custom Post Carousels with Owl WordPress plugin versions prior to 1.4.12 Description: The issue concerns the use of the featherlight library and the data-featherlight attribute without proper sanitization. This could potentially lead to...

MAL-2025-5351 Malicious code in @saas2/utils (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 415c508ae0e427d4007ed1f9c96d9ab01e63a55cd5fc21912650e61be219079d Any computer that has this package installed or running should be considered...

CVE-2022-50128

REJECTED CVE In the Linux kernel, the following vulnerability has been resolved: android: binder: stop saving a pointer to the VMA...

CVE-2022-50063

In the Linux kernel, the following vulnerability has been resolved: net: dsa: felix: suppress non-changes to the tagging protocol The way in which dsatreechangetagproto works is that when dsatreenotify fails, it doesn't know whether the operation failed mid way in a multi-switch tree, or it faile...