EUVD-2025-150370

In the Linux kernel, the following vulnerability has been resolved: sctp: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this...

Phantom Menace: Exploring and Enhancing the Robustness of VLA Models against Physical Sensor Attacks

Vision-Language-Action VLA models revolutionize robotic systems by enabling end-to-end perception-to-action pipelines that integrate multiple sensory modalities, such as visual signals processed by cameras and auditory signals captured by microphones. This multi-modality integration allows VLA...

Sonarr 安全漏洞

Sonarr is a software from Sonarr that helps find, download and organize TV shows. A security vulnerability exists in Sonarr version 4.0.15.2940 that stems from improperly set default permissions and could lead to a local environment attack...

How Worrying Are Privacy Attacks against Machine Learning?

In several jurisdictions, the regulatory framework on the release and sharing of personal data is being extended to machine learning ML. The implicit assumption is that disclosing a trained ML model entails a privacy risk for any personal data used in training comparable to directly releasing tho...

Siemens SIMATIC S7-1500 Improper Restriction of XML External Entity Reference (CVE-2016-9318)

libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity XXE attacks via a crafte...

Malicious code in sonic-kots-jaufajab (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2e915719a8df4400def253efcfc08f058bfd1ac9093b10cf7f589e389001068 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in flights-lutg-odli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f0d885e2deaea4d84ac5a093806a77d24b206975b1c1e90b36a42f5f3e19895 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in masv-ilimo-civufaa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d4662fe9d06fcd84b06fa641c844cb59864d1936e8c7e5c93a0f31a80a85c68 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-183003 Malicious code in itale-dci-rfrttr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3a0647df2f9cb098e344f97eeda7f412f9a22a5678e0f46cd36c7ff164312da This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-40204

In the Linux kernel, the following vulnerability has been resolved: sctp: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this...

UBUNTU-CVE-2025-40204

In the Linux kernel, the following vulnerability has been resolved: sctp: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this...

CVE-2025-40204 sctp: Fix MAC comparison to be constant-time

In the Linux kernel, the following vulnerability has been resolved: sctp: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this...

CVE-2025-40204

Vulnerability CVE-2025-40204 in the Linux kernel affects SCTP MAC comparison; the issue is resolved by ensuring constant-time MAC comparisons. The advisory texts explicitly state that the fix is in the Linux kernel SCTP code and aim to prevent timing attacks. Connected documents also show multipl...

Malicious code in baso95 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40fa99661cef77900a53cec9544cd3cd99c9a978c60aecc45cec814557169065 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in polymer-gibogagaa-agka (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df813c17c790a515379693b453fffb5e933c8f1b2e6c3bcde717c0bf46fae040 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-172636 Malicious code in @mipta1/r2seads (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4065dd1a960c3fb93d4e52b6d8eedf94014df0020f347fc1804019456563da0e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-174740 Malicious code in hitachi-poke96 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfbc9030235bea7ed078870a6aefe342da444f17ce0bb4ccbc7c08f374f2d921 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-178901 Malicious code in teagod-naiman18 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33ec439c42d8c1e6f847d9c8157db121fc0f28744c333c46b2928b5c2fef1c85 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-172741 Malicious code in ahunim-satf-anj (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector effc96829195e72cb0965bef60ae534ce9eb779d8b3775d3caa276730c11fe45 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-171987 Malicious code in vinitsharma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6742ebb05acf693f42e64f11ea7ec37949599af2dce5c0f6c206061f2dab08f3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...