Malicious code in internal-utils (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c0d00b355d25f3b655de9e0b371123c75c0761a20b1bb05f7d45dcf595586070 The OpenSSF Package Analysis project identified 'internal-utils' @...

MAL-2025-5625 Malicious code in plugin-meta-extractor (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8afae718387e4b2dfc69c8abec1fa53bf680355cc9e412cbeedfa77c47ac2f6b Any computer that has this package installed or running should be considered...

MAL-2025-5624 Malicious code in cmr-graphql (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b805bd73c447ee03b3330e1a1ce27c4b8edef17d58376cd0a35c151f7c1250a0 Any computer that has this package installed or running should be considered...

Rethinking and Exploring String-Based Malware Family Classification in the Era of LLMs and RAG

Malware Family Classification MFC aims to identify the fine-grained family e.g., GuLoader or BitRAT to which a potential malware sample belongs, in contrast to malware detection or sample classification that predicts only an Yes/No. Accurate family identification can greatly facilitate automated...

Exploit for Out-of-bounds Read in Citrix Netscaler_Application_Delivery_Controller

CVE-2025-5777-CitrixBleed CitrixBleed-2 CVE-2025-5777 – proo...

CVE-2025-38215

In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix doregisterframebuffer to prevent null-ptr-deref in fbvideomodetovar If fbaddvideomode in doregisterframebuffer fails to allocate memory for fbvideomode, it will later lead to a null-ptr dereference in fbvideomodetovar,...

Malicious code in ai-app-foundation (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0bdcc3a8b6070b61e7d7af657fdf20806e88b4ff4cd6bf5db9838083b10e6996 Any computer that has this package installed or running should be considered...

Malicious code in old-header-parser (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 315f759e577d29f8c6922c09f69169b191d3c8886bae205c9d3925d4a366688d Any computer that has this package installed or running should be considered...

CVE-2025-38217

In the Linux kernel, the following vulnerability has been resolved: hwmon: ftsteutates Fix TOCTOU race in ftsread In the ftsread function, when handling hwmonpwmautochannelstemp, the code accesses the shared variable data-fansourcechannel twice without holding any locks. It is first checked again...

CVE-2025-38183

In the Linux kernel, the following vulnerability has been resolved: net: lan743x: fix potential out-of-bounds write in lan743xptpioeventclockget Before calling lan743xptpioeventclockget, the 'channel' value is checked against the maximum value of PCI11X1XPTPIOMAXCHANNELS8. This seems correct and...

CVE-2025-38217 hwmon: (ftsteutates) Fix TOCTOU race in fts_read()

In the Linux kernel, the following vulnerability has been resolved: hwmon: ftsteutates Fix TOCTOU race in ftsread In the ftsread function, when handling hwmonpwmautochannelstemp, the code accesses the shared variable data-fansourcechannel twice without holding any locks. It is first checked again...

CVE-2025-38183 net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get()

In the Linux kernel, the following vulnerability has been resolved: net: lan743x: fix potential out-of-bounds write in lan743xptpioeventclockget Before calling lan743xptpioeventclockget, the 'channel' value is checked against the maximum value of PCI11X1XPTPIOMAXCHANNELS8. This seems correct and...

CVE-2025-38183

CVE-2025-38183 relates to a Linux kernel lan743x driver issue where lan743x_ptp_io_event_clock_get() could write past ptp->extts[] because LAN743X_PTP_N_EXTTS was 4 while channel could be up to 7. The root cause is an out-of-bounds write in extts[channel] when updating local timestamps. The fi...

Malicious code in with-next-intl (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3d19de7a1f0382187b4331c426d9c88dddd8734112cac8bfd611c4edadf922ad Any computer that has this package installed or running should be considered...

MAL-2025-5654 Malicious code in malicus (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d151385056670ff22bfb80dc356c10ff622a77e115f8d81ee5f066220e05fda1 The only goal of the package is to execute a webhook or a suspicious file during installation. Closely related to 2025-07-0x9xnx - created after previous...

MAL-2025-5655 Malicious code in maliinn (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 dea697dc03b11e99e6895070c9fa053b8db92510a03201f9545dcb25bd373199 The only goal of the package is to execute a webhook or a suspicious file during installation. Closely related to 2025-07-0x9xnx - created after previous...

MAL-2025-5653 Malicious code in hellodista (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 988e08e45c0c2fdbdf337e012d3930d14eedbe4add858a55cee2156849033b90 Series of packages mostly with an obfuscated infostealer attempting to collect Chrome data. While discord webhook is usually set to an example, there are other...

Malicious code in buzzwordcrm (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 940f87e50ab955b94dc0592711a21d19b9c1c962229c927531aef0816bf7ae2a Any computer that has this package installed or running should be considered...

We Urgently Need Privilege Management in MCP: a Measurement of API Usage in MCP Ecosystems

The Model Context Protocol MCP has emerged as a widely adopted mechanism for connecting large language models to external tools and resources. While MCP promises seamless extensibility and rich integrations, it also introduces a substantially expanded attack surface: any plugin can inherit broad...

Breaking the Bulkhead: Demystifying Cross-Namespace Reference Vulnerabilities in Kubernetes Operators

Kubernetes Operators, automated tools designed to manage application lifecycles within Kubernetes clusters, extend the functionalities of Kubernetes, and reduce the operational burden on human engineers. While Operators significantly simplify DevOps workflows, they introduce new security risks. I...