User Behavior Analysis in Privacy Protection with Large Language Models: a Study on Privacy Preferences with Limited Data

With the widespread application of large language models LLMs, user privacy protection has become a significant research topic. Existing privacy preference modeling methods often rely on large-scale user data, making effective privacy preference analysis challenging in data-limited environments...

CVE-2025-46335

Mobile Security Framework MobSF is a security research platform for mobile applications in Android, iOS and Windows Mobile. A Stored Cross-Site Scripting XSS vulnerability has been identified in MobSF versions up to and including 4.3.2. The vulnerability arises from improper sanitization of...

Malicious code in antani-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8bc6ee4654a6ce0b1ac821dfabae9daec5d7ffc8149ea0fdb78a2230493cf4f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SpyCloud Analysis Reveals 94% of Fortune 50 Companies Have Employee Data Exposed in Phishing Attacks

Austin, USA / Texas, 7th May 2025, CyberNewsWire...

MAL-2025-3666 Malicious code in ias-dashboard-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7c5e715ecf1204e540d58dcb1f94d07ca5724d7a1a0df89b355dbe88545c5185 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3664 Malicious code in @ai-document-translation/ui-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c8c94ea05205ad6ac8c809be2fa22e18fae368f27f1f8bd34048528dc25daa90 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3715 Malicious code in crypto-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 21ee45d9d771c938c2a2830fda64f84172fe28c001cb1dd2d725b2c05ea39068 The OpenSSF Package Analysis project identified 'crypto-provider' @ 0.3.4 npm as malicious. It is considered malicious because: - The package...

Do Not Install Development and Compilation Tools

Compilation tools in the service environment may be exploited by attackers to edit, tamper with, and perform reverse analysis on key files in the environment. Therefore, in the production environment, do not install compilation, decompilation, binary analysis tools, and compilation environments...

Do Not Allow Globally Writable Files

Globally writable files can be written by any user in the system, which is generally not needed. If a file is improperly set to globally writable, the file can be easily tampered with by attackers, causing security risks. Therefore, if a file is required to be globally writable, the actual scenar...

CVE-2025-46736

CVE-2025-46736 affects the Umbraco CMS (a .NET-based open source content management system). The issue allows user enumeration by analyzing the timing of post-login API responses, enabling an attacker to determine if an account exists. Affected versions are prior to 10.8.10 and 13.8.1. The vulner...

GHSA-4G8M-5MJ5-C8XG Umbraco Makes User Enumeration Feasible Based on Timing of Login Response

Impact Based on an analysis of the timing of post login API responses, it's possible to determine whether an account exists. Patches Patched in 10.8.10 and 13.8.1. Workarounds None available...

Observable Response Discrepancy

Overview Affected versions of this package are vulnerable to Observable Response Discrepancy due to the timing analysis of post-login API responses. An attacker can determine if a specific user account exists by observing the response times. Remediation Upgrade Umbraco.Cms.Web.BackOffice to versi...

MAL-2025-3603 Malicious code in testveriftest1asdlaaaaa (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ff36b3e2ad882727ed964a43d4599f3713d2bada89b6cec169d727127c21c2fa During installation, the package attempts to exfiltrate cloud tokens --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in testveriftest1asdlaaaa (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3b241cae62c005e3cd31a8251941ab101ebcca75aa4c8cb988905e87529339cd During installation, the package attempts to exfiltrate cloud tokens --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

MAL-2025-3602 Malicious code in testveriftest1asdlaaaa (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3b241cae62c005e3cd31a8251941ab101ebcca75aa4c8cb988905e87529339cd During installation, the package attempts to exfiltrate cloud tokens --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

CBL Mariner 2.0 Security Update: kernel (CVE-2025-21715)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-21715 advisory. - In the Linux kernel, the following vulnerability has been resolved: net: davicom: fix UAF in dm9000drvremove...

A Study on Audio Synchronous Steganography Detection and Distributed Guide Inference Model Based on Sliding Spectral Features and Intelligent Inference Drive

With the rise of short video platforms in global communication, embedding steganographic data in audio synchronization streams has emerged as a new covert communication method. To address the limitations of traditional techniques in detecting synchronized steganography, this paper proposes a...

CBL Mariner 2.0 Security Update: kernel (CVE-2025-21996)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-21996 advisory. - In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix uninitialized size issue...

Azure Linux 3.0 Security Update: kernel (CVE-2025-21996)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-21996 advisory. - In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix uninitialized size issue...

LlamaFirewall: an Open Source Guardrail System for Building Secure AI Agents

Large language models LLMs have evolved from simple chatbots into autonomous agents capable of performing complex tasks such as editing production code, orchestrating workflows, and taking higher-stakes actions based on untrusted inputs like webpages and emails. These capabilities introduce new...