CVE-2025-59374

"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. Only devices that...

CVE-2025-59374

The CVE-2025-59374 entry describes a supply-chain compromise in ASUS Live Update, where unauthorized modifications were distributed in several historical builds. Affected versions include ASUS Live Update prior to 3.6.8 and versions 3.6.8–3.6.15, with End-of-Support reached in October 2021. The v...

EUVD-2025-203872

"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. Only devices that...

CVE-2025-59374

"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. Only devices that...

CVE-2025-59374

"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. Only devices that...

📄 WordPress GiveWP Donation 3.14.1 PHP Object Injection

WordPress GiveWP Donation Fundraising Platform version 3.14.1 suffers from a PHP code injection vulnerability. This script exploits a different vector than the prior submissions from this researcher...

VulnCheck KEV: CVE-2025-59374

"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. Only devices that...

ASUS Live Update 安全漏洞

ASUS Live Update is an automated driver and firmware update tool from Asus China. A security vulnerability exists in ASUS Live Update, which stems from a supply chain attack that results in a tampered version, which could cause the device to perform unintended operations...

ASUS Live Update Embedded Malicious Code Vulnerability

ASUS Live Update contains an embedded malicious code vulnerability client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. The impacted produc...

7ghost-cli (>=1.17.6-next.0, <=1.18.4), @agentuity/evals (>=0.0.104, <=2.0.30) +389 more potentially affected by CVE-2025-68154 via systeminformation (>=5.0.6, <=5.27.13)

systeminformation NPM version =5.0.6, =1.17.6-next.0, =0.0.104, =3.0.0-alpha.0, =0.0.6, =0.0.63, =0.0.2, =3.0.0-alpha.0, =0.1.1, =0.1.1, =4.1.0-rc.4, =4.0.0-devnet.2-patch.0, =0.0.1-2.1-beta-provision, =1.0.10, =0.0.0-test.0, =6.0.0-nightly.20260812 and more Source cves: CVE-2025-68154 Source...

@0x/swap-ts-sdk (>=2.0.0, <=2.2.0-beta.1), @airbase/airbase-cli (>=2.0.0-alpha.7, <=3.0.0-beta.15) +53 more potentially affected by CVE-2025-68130 via @trpc/server (>=10.27.1, <=10.45.2)

@trpc/server NPM version =10.27.1, =2.0.0, =2.0.0-alpha.7, =2.18.0, =1.0.0, =0.2.0, =0.1.9, =0.1.0, =0.9.0-dev.1, =0.5.0-rc.5, =0.0.2, =0.0.1, =0.3.1 - @jvl/api 1.0.0 and more Source cves: CVE-2025-68130 Source advisory: OSV:GHSA-43P4-M455-4F4J...

SoundCloud, Pornhub, and 700Credit all reported data breaches, but the similarities end there

Comparing data breaches is like comparing apples and oranges. They differ on many levels. To news media, the size of the brand, how many users were impacted, and how it was done often dominate the headlines. For victims, what really matters is the type of information stolen. And for the...

AIAuditTrack: A Framework for AI Security System

The rapid expansion of AI-driven applications powered by large language models has led to a surge in AI interaction data, raising urgent challenges in security, accountability, and risk traceability. This paper presents AiAuditTrack AAT, a blockchain-based framework for AI usage traffic recording...

@luxos/share-panel (>=1.0.0, <=1.0.3), @types/cordova-plugin-x-socialsharing (>=5.4.5, <=5.4.8) +4 more potentially affected by CVE-2025-65835 via cordova-plugin-x-socialsharing (>=5.6.8, <=6.0.4)

cordova-plugin-x-socialsharing NPM version =5.6.8, =1.0.0, =5.4.5, =0.0.1, =1.0.0 - radoo-odc-app 0.0.1 Source cves: CVE-2025-65835 Source advisory: SNYK:JS-CORDOVAPLUGINXSOCIALSHARING-14426472...

A Browser Extension Risk Guide After the ShadyPanda Campaign

In early December 2025, security researchers exposed a cybercrime campaign that had quietly hijacked popular Chrome and Edge browser extensions on a massive scale. A threat group dubbed ShadyPanda spent seven years playing the long game, publishing or acquiring harmless extensions, letting them r...

CVE-2025-14476

The Doubly – Cross Domain Copy Paste for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.46 via deserialization of untrusted input from the content.txt file within uploaded ZIP archives. This makes it possible for authenticated...

CVE-2025-61727

A flaw was found in the crypto/x509 package in the Go standard library. This vulnerability allows a certificate validation bypass via an excluded subdomain constraint in a certificated chain as it does not restrict the usage of wildcard SANs in the leaf certificate. Mitigation Mitigation for this...

MicrosoftAmplifierPoC

Microsoft Amplifier RCE PoC Proof of concept demonstrating re...

Denial Of Service (DoS)

urllib3 is vulnerable to a Denial-Of-Service DoS. The vulnerability is due to an unbounded decompression chain, where nested compression layers are not limited, allowing a malicious server to send specially crafted responses that trigger excessive CPU usage and large memory allocation during...

@inkeep/agents-manage-ui (>=0.0.0-dev-20251211233416, <=0.38.0), @react-email/preview-server (5.0.8) +1 more potentially affected by unknown CVE via next (16.0.9)

next NPM version 16.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on next and may be impacted: - @inkeep/agents-manage-ui =0.0.0-dev-20251211233416, =0.38.0 - @react-email/preview-server 5.0.8 - @tulip-systems/core 0.4.1 Source cves: unknown CVE...