2197 matches found
CVE-2025-64486 calibre is vulnerable to arbitrary code execution when opening FB2 files
calibre is an e-book manager. In versions 8.13.0 and prior, calibre does not validate filenames when handling binary assets in FB2 files, allowing an attacker to write arbitrary files on the filesystem when viewing or converting a malicious FictionBook file. This can be leveraged to achieve...
CVE-2025-64486
calibre is an e-book manager. In versions 8.13.0 and prior, calibre does not validate filenames when handling binary assets in FB2 files, allowing an attacker to write arbitrary files on the filesystem when viewing or converting a malicious FictionBook file. This can be leveraged to achieve...
Incorrect Behavior Order
Overview ai is an AI SDK by Vercel - The AI Toolkit for TypeScript and JavaScript Affected versions of this package are vulnerable to Incorrect Behavior Order via the downloadAssets function. An attacker can upload files with disallowed types by substituting arbitrary downloaded bytes for differe...
PT-2025-45522
Name of the Vulnerable Software and Affected Versions calibre versions 8.13.0 and prior Description calibre is an e-book manager. Versions 8.13.0 and earlier do not validate filenames when handling binary assets within FB2 files. This allows an attacker to write arbitrary files to the filesystem...
What Is Attack Surface Mapping And Why It’s Critical To your Security Program
You might think an attack surface mapper is just another name for a vulnerability scanner, but they serve two very different purposes. A scanner tests the assets you already know about for specific weaknesses. An attack surface mapper answers a more fundamental question: What assets do I even hav...
About the security content of macOS Sonoma 14.8.2
About the security content of macOS Sonoma 14.8.2 This document describes the security content of macOS Sonoma 14.8.2. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or release...
About the security content of macOS Sonoma 14.8.2
About the security content of macOS Sonoma 14.8.2 This document describes the security content of macOS Sonoma 14.8.2. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or release...
About the security content of tvOS 26.1
About the security content of tvOS 26.1 This document describes the security content of tvOS 26.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...
About the security content of visionOS 26.1
About the security content of visionOS 26.1 This document describes the security content of visionOS 26.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are...
About the security content of visionOS 26.1
About the security content of visionOS 26.1 This document describes the security content of visionOS 26.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are...
Attack Surface Exposures: A Practical Guide
Many security teams believe their existing tools have them fully covered. With a firewall, endpoint protection, and a vulnerability scanner, it’s easy to assume you can see everything that matters. This is one of the most dangerous myths in cybersecurity today. These tools often operate in silos,...
CVE-2025-41090
microCLAUDIA in v3.2.0 and prior has an improper access control vulnerability. This flaw allows an authenticated user to perform unauthorized actions on other organizations' systems by sending direct API requests. To do so, the attacker can use organization identifiers obtained through a...
A Practical Guide to Attack Surface Intelligence Mapping
Think of your organization’s digital presence as a sprawling, ever-expanding city. New buildings servers go up, old ones are forgotten, and unofficial shortcuts shadow IT appear overnight. Trying to defend this city without a current map is impossible. You’re left reacting to alarms instead of...
Cross-site Scripting (XSS)
com.liferay, com.liferay.dynamic.data.mapping.form.field.type is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper validation of user-supplied input in "Rich Text" type fields within web content structures, document types, or custom assets using the Data Engine module,...
MAL-2025-48752 Malicious code in peloton-creative-assets (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 27599b248968e9e2ea7e7167ee3199163e611123d5a34c382d7041a04ade757e The OpenSSF Package Analysis project identified...
Malicious code in peloton-creative-assets (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 27599b248968e9e2ea7e7167ee3199163e611123d5a34c382d7041a04ade757e The OpenSSF Package Analysis project identified...
EUVD-2025-35003
A security vulnerability has been detected in LibreWolf up to 143.0.4-1 on Windows. This affects an unknown function of the file assets/setup.nsi of the component Installer. Such manipulation leads to uncontrolled search path. The attack must be carried out locally. Attacks of this nature are...
CVE-2025-11940
The CVE-2025-11940 vulnerability affects LibreWolf up to 143.0.4-1 on Windows, tied to an unknown function in assets/setup.nsi of the Installer component. It enables an uncontrolled search path and requires local access from the attacker; the exploitability is described as difficult. A fix is ava...
A Strategic Response to the F5 BIG-IP Nation-State Breach 2025
In mid-October 2025, the cybersecurity landscape was dealt a severe blow. F5 disclosed a long-term, sophisticated breach by a nation-state threat actor. This incident exposed critical F5 BIG-IP vulnerabilities and triggered heightened scrutiny across enterprise edge infrastructure. This was not a...
Beyond CVSS: Critical CVE Vulnerabilities Analysis
Attackers don't care about your CVSS scores. They care about finding a path into your network. That path might not be a single, glaring "critical" vulnerability. Often, it’s a chain of lower-severity weaknesses on overlooked assets that, when combined, give them the keys to the kingdom. This is w...