BIT-GOLANG-2025-61727 Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509

An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN .example.com...

CVE-2025-66559

Taiko Alethia is an Ethereum-equivalent, permissionless, based rollup designed to scale Ethereum without compromising its fundamental properties. In 2.3.1 and earlier, TaikoInbox.verifyBatches packages/protocol/contracts/layer1/based/TaikoInbox.sol:627-678 advanced the local tid to whatever...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 React2Shell - Proof of Concept ⚠️ WARNIN...

GHSA-GM62-XV2J-4W53 urllib3 allows an unbounded number of links in the decompression chain

Impact urllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 e.g., Content-Encoding: gzip, zstd. However, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps...

CVE-2025-66418 urllib3 allows an unbounded number of links in the decompression chain

urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory...

EUVD-2025-201389

Malicious code in chai-promised-chain npm...

Malicious code in chai-promised-chain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a501d6eba591eb49cf120c8aee8c4e0600aacf2263984d3ae14e0d1b53daa92 The package chai-promised-chain was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview chai-promised-chain is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2025-192319 Malicious code in chai-promised-chain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a501d6eba591eb49cf120c8aee8c4e0600aacf2263984d3ae14e0d1b53daa92 The package chai-promised-chain was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-201327

Malicious code in react-svg-fill npm...

urllib3 安全漏洞

urllib3 is a Python HTTP library open-sourced by urllib3. It features thread-safe connection pooling, file publishing support, and more. A security vulnerability exists in urllib3 version 1.24 up to and including version 2.6.0, which stems from an unlimited number of links in the decompression...

CVE-2025-66559

Taiko Alethia is an Ethereum-equivalent, permissionless, based rollup designed to scale Ethereum without compromising its fundamental properties. In 2.3.1 and earlier, TaikoInbox.verifyBatches packages/protocol/contracts/layer1/based/TaikoInbox.sol:627-678 advanced the local tid to whatever...

EUVD-2025-201290

Taiko Alethia is an Ethereum-equivalent, permissionless, based rollup designed to scale Ethereum without compromising its fundamental properties. In 2.3.1 and earlier, TaikoInbox.verifyBatches packages/protocol/contracts/layer1/based/TaikoInbox.sol:627-678 advanced the local tid to whatever...

CVE-2025-66559 Taiko Alethia Pacaya inbox verification pointer corruption

Taiko Alethia is an Ethereum-equivalent, permissionless, based rollup designed to scale Ethereum without compromising its fundamental properties. In 2.3.1 and earlier, TaikoInbox.verifyBatches packages/protocol/contracts/layer1/based/TaikoInbox.sol:627-678 advanced the local tid to whatever...

CVE-2025-66509 LaraDashboard: 1-Click Pre-Auth RCE via Host Header + Module Installation Chain

LaraDashboard is an all-In-one solution to start a Laravel Application. In 2.3.0 and earlier, the password reset flow trusts the Host header, allowing attackers to redirect the administrator’s reset token to an attacker-controlled server. This can be combined with the module installation process ...

5 Threats That Reshaped Web Security This Year [2025]

As 2025 draws to a close, security professionals face a sobering realization: the traditional playbook for web security has become dangerously obsolete. AI-powered attacks, evolving injection techniques, and supply chain compromises affecting hundreds of thousands of websites forced a fundamental...

Exploit for CVE-2025-55182

CVE-2025-55182 - React Server Components Prototype Chain Vulne...

Exploit for CVE-2025-55182

CVE-2025-55182 - React Server Components Prototype Chain Vulne...

Exploit for CVE-2025-55182

CVE-2025-55182 Proof of Concept Critical Pre-Authenticati...

Taiko Alethia 输入验证错误漏洞

Taiko Alethia is a collection of software open-sourced by Taiko Labs for implementing the Ethernet-based ZK-EVM Rollup protocol for the Taiko Layer 2 network. An input validation error vulnerability exists in Taiko Alethia 2.3.1 and earlier versions, which stems from the TaikoInbox.verifyBatches...