HCL DevOps Velocity 安全漏洞

HCL DevOps Velocity is a pipeline orchestration and management tool used by HCL Company in India. Versions of HCL DevOps Velocity prior to 5.1.7 contained security vulnerabilities. These vulnerabilities were due to improper implementation of rate-limiting mechanisms for login attempts, which coul...

Anthropic's Claude Mythos Finds Thousands of Zero-Day Flaws Across Major Systems

Artificial Intelligence AI company Anthropic announced a new cybersecurity initiative called Project Glasswing that will use a preview version of its new frontier model, Claude Mythos , to find and address security vulnerabilities. The model will be used by a small set of organizations, including...

Vulnerability Abundance: A Formal Proof of Infinite Vulnerabilities in Code

We present a constructive proof that a single C program, the Vulnerability Factory, admits a countably infinite set of distinct, independently CVE-assignable software vulnerabilities. We formalise the argument using elementary set theory, verify it against MITRE's CVE Numbering Authority counting...

Strengthening secure software at global scale: How MSRC is evolving with AI

Cybersecurity has always been a race between defenders and attackers, constrained by human time, attention, and scale. What is changing now is the level of capability available to apply security fundamentals with far greater reach and speed...

Malicious code in adobe_pipeline_test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7e438937c9c04fd06645a505f5bd509ee3c1fa942be02cefa881023f849b781 The package adobepipelinetest was found to contain malicious code...

GHSA-RW66-G8V8-WCWH vulnerabilities

Vulnerabilities for packages: chromium...

Secure-Programming-and-Exploiting-Vulnerabilities

Secure-P...

Malicious code in translation-note (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e07633850d68301541c30e7f731a444071e400f71083928dca6418a9a59c769a The package translation-note was found to contain malicious code. Source: ghsa-malware 95cfe5df95e94bc56327c2241fd1d850ee8bae580cdecfae84ee6f81f09150...

DEBIAN-CVE-2025-62291

In the eap-mschapv2 plugin client-side in strongSwan before 6.0.3, a malicious EAP-MSCHAPv2 server can send a crafted message of size 6 through 8, and cause an integer underflow that potentially results in a heap-based buffer overflow...

Malicious code in vue_frontend_rpc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37b3b39f0c20a8dd65bccdba671ecc5761e03146f454226847e982c424b8c25b The package vuefrontendrpc was found to contain malicious code. Source: ghsa-malware 30e31020ae5911a45b568d33238a4785bb2149dc1a8b474ac220aacb60546551...

CVE-2023-45055

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in InspireUI MStore API allows SQL Injection.This issue affects MStore API: from n/a through 4.0.6...

CVE-2020-10626

In Fazecast jSerialComm, Version 2.2.2 and prior, an uncontrolled search path element vulnerability could allow a malicious DLL file with the same name of any resident DLLs inside the software installation to execute arbitrary code...

CVE-2024-34310

Jin Fang Times Content Management System v3.2.3 was discovered to contain a SQL injection vulnerability via the id parameter...

CVE-2024-34909

An arbitrary file upload vulnerability in KYKMS v1.0.1 and below allows attackers to execute arbitrary code via uploading a crafted PDF file...

CVE-2025-23766

Missing Authorization vulnerability in ashamil OPSI Israel Domestic Shipments woo-ups-pickup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects OPSI Israel Domestic Shipments: from n/a through = 2.8.2...

CVE-2025-23529

Missing Authorization vulnerability in blokhauswp Minterpress minterpress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Minterpress: from n/a through = 1.0.5...

CVE-2021-22532

Possible NLDAP Denial of Service attack Vulnerability in eDirectory has been discovered in OpenText™ eDirectory before 9.2.4.0000...

CVE-2021-22190

A path traversal vulnerability via the GitLab Workhorse in all versions of GitLab could result in the leakage of a JWT token...

CVE-2021-22224

A cross-site request forgery vulnerability in the GraphQL API in GitLab since version 13.12 and before versions 13.12.6 and 14.0.2 allowed an attacker to call mutations as the victim...

CVE-2025-23609

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Helle1 Tagesteller tagesteller allows Reflected XSS.This issue affects Tagesteller: from n/a through = v.1.1...