2757 matches found
CVE-2025-65026
CVE-2025-65026 affects esm.sh prior to version 136. The vulnerability arises when the CSS-to-JavaScript module conversion inserts CSS into a JavaScript template literal without sanitization, allowing template literals to execute ${...} expressions. This can enable XSS in browsers and potential RC...
CVE-2025-52457
Observable Timing Discrepancy CWE-208 in HBUS devices may allow an attacker with physical access to the device to extract device-specific keys, potentially compromising further site security. This issue affects Command Centre Server: 9.30 prior to vCR9.30.251028a distributed in 9.30.2881 MR3, 9.2...
CVE-2025-64734
Missing Release of Resource after Effective Lifetime CWE-772 in the T21 Reader allows an attacker with physical access to the Reader to perform a denial-of-service attack against that specific reader, preventing cardholders from badging for entry. This issue affects Command Centre Server: 9.30...
CVE-2025-12955
The CVE-2025-12955 issue affects the WordPress plugin Live Sales Notification for WooCommerce (versions up to and including 2.3.39). The root cause is missing authorization and capability checks in the getOrders function when configured to display recent orders, allowing unauthenticated users to ...
Chinese State Hackers Jailbroke Claude AI Code for Automated Breaches
Anthropic, the developer behind Claude AI, says a Chinese state sponsored group used its model to automate most of a cyber espionage operation against about 30 companies with Claude handling up to 90% of the technical work...
Chinese Hackers Use Anthropic's AI to Launch Automated Cyber Espionage Campaign
State-sponsored threat actors from China used artificial intelligence AI technology developed by Anthropic to orchestrate automated cyber attacks as part of a "highly sophisticated espionage campaign" in mid-September 2025. "The attackers used AI's 'agentic' capabilities to an unprecedented degre...
SUSE CVE-2025-40199
In the Linux kernel, the following vulnerability has been resolved: pagepool: Fix PPMAGICMASK to avoid crashing on some 32-bit arches Helge reported that the introduction of PPMAGICMASK let to crashes on boot on his 32-bit parisc machine. The cause of this is the mask is set too wide, so the...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libssh (UTSA-2025-990917)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990917 advisory. There's a vulnerability in the libssh package where when a libssh consumer passes in an unexpectedly large input buffer to sshgetfingerprinthash function. In such...
CVE-2025-63289
Sogexia Android App Compile Affected SDK v35, Max SDK 32 and fixed in v36, was discovered to contain hardcoded encryption keys in the encryptionhelper.dart file...
HP Integrated Lights-Out Improper Restriction of Operations within the Bounds of a Memory Buffer (CVE-2019-11983)
A remote buffer overflow vulnerability was identified in HPE Integrated Lights-Out 4 iLO 4 earlier than v2.61b for Gen9 servers and Integrated Lights-Out 5 iLO 5 for Gen10 Servers earlier than version v1.39. This plugin only works with Tenable.ot. Please visit...
DEBIAN-CVE-2025-40199
In the Linux kernel, the following vulnerability has been resolved: pagepool: Fix PPMAGICMASK to avoid crashing on some 32-bit arches Helge reported that the introduction of PPMAGICMASK let to crashes on boot on his 32-bit parisc machine. The cause of this is the mask is set too wide, so the...
UBUNTU-CVE-2025-40199
In the Linux kernel, the following vulnerability has been resolved: pagepool: Fix PPMAGICMASK to avoid crashing on some 32-bit arches Helge reported that the introduction of PPMAGICMASK let to crashes on boot on his 32-bit parisc machine. The cause of this is the mask is set too wide, so the...
CVE-2025-40199
In Linux kernel page_pool, CVE-2025-40199 is resolved by adjusting PP_DMA_INDEX_BITS instead of disabling checks, to prevent crashes on some 32-bit arches (e.g., parisc). The fix relies on the assumption that kernel pointers aliasing with the pp_magic field are above PAGE_OFFSET, allowing the low...
Malicious code in hokage-36 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae94bc8026fdffc19364a26b1475c1fc1896d88d8353984b46b7fb78b0bcfe88 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in hokage-37 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76904493617489a581b85d16f79c848dc3e8589897d9aecb6fe10846e0c96d3d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in hokage-32 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16e414bc0920a7b1727962d18e6f93944f0abadcf7ff8c8ddd13729dec02697b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-139911
Malicious code in nokire-kushina30 npm...
Malicious code in ira-31 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a6f78612ee844c31f021244015d21b9e0b616b75792a73700a840d88806ff5c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...