PT-2025-52391

Name of the Vulnerable Software and Affected Versions NSF Unidata NetCDF-C affected versions not specified Description A flaw exists in the parsing of variable names, stemming from insufficient validation of user-supplied data length before copying it into a fixed-length stack-based buffer. This...

PT-2025-52388

Name of the Vulnerable Software and Affected Versions Hugging Face smolagents affected versions not specified Description A flaw exists in Hugging Face smolagents that allows remote attackers to execute arbitrary code on affected systems. Authentication is not required for exploitation. The issue...

PT-2025-52379

Name of the Vulnerable Software and Affected Versions Hugging Face Transformers affected versions not specified Description A flaw exists in Hugging Face Transformers due to insufficient validation of user-supplied data during the parsing of model files. This can lead to the deserialization of...

PT-2025-52382

Name of the Vulnerable Software and Affected Versions Hugging Face Accelerate affected versions not specified Description A flaw exists in Hugging Face Accelerate that allows remote attackers to execute arbitrary code on affected systems. Exploitation requires user interaction, such as visiting a...

Update your browser: Security fix for Chrome zero-day CVE-2025-14174

News, Security Update your browser: Security fix for Chrome zero-day CVE-2025-14174 Share December 18th, 2025 Hi everyone! The latest patches to Opera, Opera GX, Opera Air, and Opera for Android address several recent vulnerabilities, including a zero-day exploit CVE-2025-14174. We recommend...

Libbiosig, Grassroot DiCoM, Smallstep step-ca vulnerabilities

Cisco Talos' Vulnerability Discovery & Research team recently disclosed vulnerabilities in Biosig Project Libbiosig, Grassroot DiCoM, and Smallstep step-ca. The vulnerabilities mentioned in this blog post have been patched by their respective vendors, all in adherence to Cisco 's third-party...

New ForumTroll Phishing Attacks Target Russian Scholars Using Fake eLibrary Emails

The threat actor linked to Operation ForumTroll has been attributed to a fresh set of phishing attacks targeting individuals within Russia, according to Kaspersky. The Russian cybersecurity vendor said it detected the new activity in October 2025. The origins of the threat actor are presently...

CVE-2025-14424

creationtimestamp| type| source ---|---|--- 2025-12-17 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-1138/...

CVE-2025-14423

creationtimestamp| type| source ---|---|--- 2025-12-17 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-1137/...

CVE-2025-14501

creationtimestamp| type| source ---|---|--- 2025-12-17 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-1104/...

CVE-2025-14422

creationtimestamp| type| source ---|---|--- 2025-12-17 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-1136/ 2026-01-05 15:42:32+00:00| seen| https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mbornzhm7k2c...

PT-2025-51891

Name of the Vulnerable Software and Affected Versions SonicWall SMA1000 versions prior to 12.4.3-03245 and 12.5.0-02283 SonicWall SMA 100 series appliances affected versions not specified Description A local privilege escalation vulnerability exists in the SonicWall SMA1000 appliance management...

IE Mode: A Window to the Web – or to Attackers?

Running short on time but still want to stay in the know? Well, we’ve got you covered! We’ve condensed all the key takeaways into a handy audio summary. Our AI-driven podcasts are fit for on the go. Recently, Internet Explorer IE Mode has been weaponized by threat actors through multiple zero-day...

An Empirical Analysis of Zero-Day Vulnerabilities Disclosed by the Zero Day Initiative

Zero-day vulnerabilities represent some of the most critical threats in cybersecurity, as they correspond to previously unknown flaws in software or hardware that are actively exploited before vendors can develop and deploy patches. During this exposure window, affected systems remain defenseless...

Welcome to the new Project Zero Blog

Posted by Natalie Silvanovich While on Project Zero, we aim for our research to be leading-edge, our blog design was … not so much. We welcome readers to our shiny new blog! For the occasion, we asked members of Project Zero to dust off old blog posts that never quite saw the light of day. And...

⚡ Weekly Recap: Apple 0-Days, WinRAR Exploit, LastPass Fines, .NET RCE, OAuth Scams & More

If you use a smartphone, browse the web, or unzip files on your computer, you are in the crosshairs this week. Hackers are currently exploiting critical flaws in the daily software we all rely on—and in some cases, they started attacking before a fix was even ready. Below, we list the urgent...

A week in security (December 8 – December 14)

Last week on Malwarebytes Labs: The US digital doxxing of H-1B applicants is a massive privacy misstep Google ads funnel Mac users to poisoned AI chats that spread the AMOS infostealer How private is your VPN? DroidLock malware locks you out of your Android device and demands ransom Malwarebytes...

PT-2025-51095

🚨 Google Chrome Eighth Zero-Day Vulnerability CVE-2025-7499109 Advisory High Dec 13, 2025 Checkout our Threat Intelligence Platform: https://t.co/QuwNtEgYh1 https://t.co/QuwNtEgYh1 ThreatIntelligence CyberSecurity Innovation LLM https://t.co/yHTrc16kSs...

PT-2025-51037

Name of the Vulnerable Software and Affected Versions Safari versions prior to 26.2 iOS versions prior to 18.7.3 iOS versions prior to 26.2 iPadOS versions prior to 18.7.3 iPadOS versions prior to 26.2 macOS Tahoe versions prior to 26.2 tvOS versions prior to 26.2 visionOS versions prior to 26.2...

AIs Exploiting Smart Contracts

I have long maintained that smart contracts are a dumb idea: that a human process is actually a security feature. Here's some interesting research on training AIs to automatically exploit smart contracts: AI models are increasingly good at cyber tasks, as we've written about before. But what is t...