Malicious code in aware-green-wren (npm)

Source: amazon-inspector 96ecaa8e5d489da8fc6300724abceb1a13ab27e726efeec892bcca01bc50f371 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

DakshSCRA v0.38-beta

Daksh SCRA Source Code Review Assist root@kitploit: Author: - Debasis Mohanty [email protected] - Twitter / X: @coffeensecurity - www.coffeeandsecurity.com About Daksh SCRA Daksh SCRA Source Code Review Assist tool is built to enhance the efficiency of the source code review process, providi...

SysComb: Fine-Grained Transparent System Call Filtering for Attack Surface Reduction

Restricting the system calls available to applications shrinks the kernel's attack surface and greatly mitigates the impact of compromised programs. Recent approaches showcase techniques to generate system call filters, however, all existing solutions require either kernel or application...

PT-2026-82276

『A vulnerability that causes guest OS credentials used for Application Aware processing to be recorded in cleartext in logs on the guest machine.』 CVE-2026-58070 Severity: Medium KB4902: Vulnerability Resolved in Veeam Backup & Replication 13.1 https://t.co/FR1ctYoEZc...

Vulnerabilities Resolved in Veeam Backup & Replication 13.1

Veeam Software Security Commitment Veeam® is committed to ensuring its products protect customers from potential risks. As part of that commitment, we operate a Vulnerability Disclosure Program VDP for all Veeam products and perform extensive internal code audits. When a vulnerability is...

Vibe Coding and Web Application Security: A Twin-Prompt Study

Large language models increasingly generate complete web applications from natural-language prompts, raising the question of whether explicitly requesting security best practice improves the result. We study six functionally distinct web applications, each generated in two prompt variants that ar...

PT-2026-73241

Apache Airflow's asset materialization endpoint POST /api/v2/assets/asset id/materialize and the XCom result check on wait dag run until finished authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a...

GHSA-5247-M8W9-2V4M Apache Airflow missing team context permits cross-team Dag actions and XCom reads

Apache Airflow's asset materialization endpoint POST /api/v2/assets/assetid/materialize and the XCom result check on waitdagrununtilfinished authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global o...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the POST /api/v2/assets/assetid/materialize endpoint and the XCom result check on waitdagrununtilfinished. An attacker can access and manipulate DAG runs and read XCom values belonging to other teams by supplyin...

PT-2026-102298

Apache Airflow's asset materialization endpoint POST /api/v2/assets/asset id/materialize and the XCom result check on wait dag run until finished authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a...

CVE-2026-34175

Uncontrolled search path for some Hardware-Aware-Automated-MachineLearning NA before version 45cd723 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of...

CVE-2026-34175

Uncontrolled search path for some Hardware-Aware-Automated-MachineLearning NA before version 45cd723 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of...

CVE-2026-34175

Uncontrolled search path for some Hardware-Aware-Automated-MachineLearning NA before version 45cd723 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of...

CVE-2026-34175

Uncontrolled search path for some Hardware-Aware-Automated-MachineLearning NA before version 45cd723 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of...

CVE-2026-34175

Affected software: Hardware-Aware-Automated-MachineLearning NA (pre-45cd723) within Ring 3: User Applications. Vulnerability: Uncontrolled search path leading to local privilege escalation. Root cause: improper handling of search paths; enables escalation of privilege when a privileged user and u...

CVE-2026-6726: Incorrect Type Conversion or Cast

An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key such as an Attestation Key, DevID Key or TLS authentication key and falsify other TPM 2...

Hardware Aware Automated Machine Learning Software Advisory

Summary: A potential security vulnerability for some Hardware Aware Automated Machine Learning software may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2026-34175 Description: Uncontrolled search pa...

PT-2026-70340

🚨 CVE-2026-34175 Uncontrolled search path for some Hardware-Aware-Automated-MachineLearning NA before version 45cd723 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable...

CVE-2026-34175: Uncontrolled Search Path Element

Uncontrolled search path for some Hardware-Aware-Automated-MachineLearning NA before version 45cd723 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of...

Security Bulletin: Vulnerability in tritonclient bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Content-Aware Storage.

Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Content-Aware Storage include the tritonclient library, which is affected by a denial of service vulnerability. CVE-2025-33202. Vulnerability Details CVEID:CVE-2025-33202 DESCRIPTION: NVIDIA Triton Inference Server for Linux and Windows contains ...