PT-2025-53178

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the driver subsystem, specifically in the soc/xilinx component. A use-after-free condition exists due to the improper handling of a hash table...

Lazarus Group Embed New BeaverTail Variant in Developer Tools

North Korea’s Lazarus Group deploys a new BeaverTail variant to steal credentials and crypto using fake job lures, dev tools, and smart contracts...

Security update for glib2

This update for glib2 fixes the following issues: CVE-2025-14512: integer overflow in the GIO escapebytestring function when processing malicious files or remote filesystem attribute values can lead to denial-of-service bsc1254878. CVE-2025-14087: buffer underflow in the GVariant parser...

MAL-2025-192436 Malicious code in jsonschema-utf8 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 61bf4fa82a7c398e580d547d641bc19e3b16ba446191da04f39dcf9cf9a41eab Package clones a popular package loguru, jsonschema, .... While it claims to have some additional features, the real change is an added compiled native library...

CGA-644H-55G8-MMPX

Bulletin has no description...

EUVD-2025-200987

A local privilege escalation vulnerability exists in the InstallationHelper service included with Plugin Alliance Installation Manager v1.4.0 for macOS. The service accepts unauthenticated XPC connections and executes input via system, which may allow a local user to execute arbitrary commands wi...

MAL-2025-191553 Malicious code in tailwind-scrollbar-variant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c7a64f578e119daa50df50bd0cd9178bd4035b7ca595a72dc2b10da57b658d9 The package tailwind-scrollbar-variant was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-200199

Malicious code in tailwind-scrollbar-variant npm...

Malicious code in tailwind-scrollbar-variant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c7a64f578e119daa50df50bd0cd9178bd4035b7ca595a72dc2b10da57b658d9 The package tailwind-scrollbar-variant was found to contain malicious code. Source: ghsa-malware...

North Korean Hackers Deploy 197 npm Packages to Spread Updated OtterCookie Malware

The North Korean threat actors behind the Contagious Interview campaign have continued to flood the npm registry with 197 more malicious packages since last month. According to Socket, these packages have been downloaded over 31,000 times, and are designed to deliver a variant of OtterCookie that...

Validator.js 安全漏洞

Validator.js is a string validator open source by validatorjs A security vulnerability exists in Validator.js versions prior to 13.15.22, which stems from the isLength function not taking into account the Unicode variant selector, which could lead to improper string length calculation...

MINI-88P4-V8V8-VV3X

Bulletin has no description...

ToddyCat: your hidden email assistant. Part 1

Introduction Email remains the main means of business correspondence at organizations. It can be set up either using on-premises infrastructure for example, by deploying Microsoft Exchange Server or through cloud mail services such as Microsoft 365 or Gmail. However, some organizations do not...

Siemens RUGGEDCOM ROS Devices Improperly Implemented Security Check for Standard (CVE-2021-42017)

A new variant of the POODLE attack has left a third-party component vulnerable due to the implementation flaws of the CBC encryption mode in TLS 1.0 to 1.2. If an attacker were to exploit this, they could act as a man-in-the-middle and eavesdrop on encrypted communications. This plugin only works...

Malicious code in mysql-spectron-webdriver-primatology-eslint-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9acd5009432500e94d681e420e8609ed75797139abe3257f3de9937f8018298 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in async-psi-alpha-query-theta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7530cf46aad481c6839f10e0bee406d9caae82ffc06acdedcc54ce75442b73cb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in supervisor-cosmicsilence-kardashevscale-ophiuchus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9573fa09b793a27dc60d132b1c9ae19d3c0b44531783b2302554c24bfa8ed91 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ini-quito-stratosphere-slides (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80addd4c113b2cc5947537311ac67c987723ef1ebcd79a98f25b63fe603be5e6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hercules-config-juno-void (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f4cd30f00323af7b524f61b17219f21295d6d27272c1dc39765553c6d27266b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in janus-dagda-query-ceres (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afb85b42a5c537dcd9141514d6280fb515d53ef44c3e7801ea47c15aa7a3fa71 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...