Denial Of Service (DoS)

urllib3 is vulnerable to a Denial-Of-Service DoS. The vulnerability is due to an unbounded decompression chain, where nested compression layers are not limited, allowing a malicious server to send specially crafted responses that trigger excessive CPU usage and large memory allocation during...

@inkeep/agents-manage-ui (>=0.0.0-dev-20251211233416, <=0.38.0), @react-email/preview-server (5.0.8) +1 more potentially affected by unknown CVE via next (16.0.9)

next NPM version 16.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on next and may be impacted: - @inkeep/agents-manage-ui =0.0.0-dev-20251211233416, =0.38.0 - @react-email/preview-server 5.0.8 - @tulip-systems/core 0.4.1 Source cves: unknown CVE...

SUSE CVE-2025-66418

urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory...

Ubuntu: Security Advisory (USN-7927-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 / 25.10 : urllib3 vulnerabilities (USN-7927-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 / 25.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7927-1 advisory. Illia Volochii discovered that urllib3 did not limit the steps in a decompression chain. An attacker could possib...

47th (0.1.0), @0xchain/auth (>=0.0.1, <=1.1.0-beta.7) +178 more potentially affected by unknown CVE via next (>=15.5.1, <=15.5.7)

next NPM version =15.5.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.7 and more Source cves: unknown CVE Source advisory: OSV:GHSA-W37M-7FHW-FMV9...

@adenta/cms (>=0.0.6, <=1.1.1-0), @alisonquinter17/alieta-ui (0.1.0) +126 more potentially affected by unknown CVE via next (>=15.4.0-canary.17, <=15.4.8)

next NPM version =15.4.0-canary.17, =0.0.6, =0.1.0, =1.2.4-main.7f918ee.29, =0.2.0, =1.0.0, =1.0.0-beta.3, =1.0.2, =0.0.1, =0.0.4, =0.0.1, =1.1.0, =0.1.3, =0.5.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-W37M-7FHW-FMV9...

@accounter/client (>=0.0.3-alpha-20241021184442-252a149a89c221b28ae459807869535922e67185, <=0.0.3-alpha-20241210194047-ed4829d58a27c1aa9634b834f5d56d78ce8c68fd), @admiral.nelson/smart-catalyst (>=1.0.19, <=1.0.24) +250 more potentially affected by unknown CVE via next (>=15.0.0, <=15.0.5)

next NPM version =15.0.0, =0.0.3-alpha-20241021184442-252a149a89c221b28ae459807869535922e67185, =1.0.19, =0.1.0, =0.0.4, =0.1.0, =0.1.11, =0.0.1-alpha, =0.0.4-alpha - @benimaru/ahgas 1.1.4 - @benimaru/asduq 1.1.4 - @benimaru/balon 1.1.4 - @benimaru/bantenss 1.1.4 - @benimaru/bbasi 1.1.4 -...

47th (0.1.0), @0xchain/auth (>=0.0.1, <=1.1.0-beta.7) +178 more potentially affected by unknown CVE via next (>=15.5.1, <=15.5.7)

next NPM version =15.5.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.7 and more Source cves: unknown CVE Source advisory: OSV:GHSA-MWV6-3258-Q52C...

47th (0.1.0), @0xchain/auth (>=0.0.1, <=1.1.0-beta.7) +194 more potentially affected by CVE-2025-55183 +1 more via next (>=15.5.0, <=15.5.7)

next NPM version =15.5.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.7 and more Source cves: CVE-2025-55183, CVE-2025-55184 Source advisory: SNYK:JS-NEXT-14400644...

Malicious Visual Studio Code Extensions Hide Trojan in Fake PNG Files

VS Code developers beware: ReversingLabs found 19 malicious extensions hiding trojans inside a popular dependency, disguising the final malware payload as a standard PNG image file...

cn.slimjoy:web-plus-job (>=1.0.0, <=1.0.2), cn.slimjoy:web-plus-starter (>=1.0.0, <=1.0.2) +61 more potentially affected by CVE-2025-14518 via tech.powerjob:powerjob-common (>=4.0.0, <=5.1.2)

tech.powerjob:powerjob-common MAVEN version =4.0.0, =1.0.0, =1.0.0, =0.0.3, =2.5.1, =2.5.1, =2.5.1, =2.5.1, =2.5.1, =2.5.1, =2.5.1, =2.5.1, =2.5.1, =2.6.1 and more Source cves: CVE-2025-14518 Source advisory: SNYK:JAVA-TECHPOWERJOB-14401157...

2026 API and AI Security Predictions: What Experts Expect in the Year Ahead

This is a predictions blog. We know, we know; everyone does them, and they can get a bit same-y. Chances are, you’re already bored with reading them. So, we’ve decided to do things a little bit differently this year. Instead of bombarding you with just our own predictions, we’ve decided to cast t...

EUVD-2025-202901

Malicious code in libxmljsololo3 npm...

EUVD-2025-202615

The ESP32 system on a chip SoC that powers the Meatmeet basestation device was found to lack Secure Boot. The Secure Boot feature ensures that only authenticated software can execute on the device. The Secure Boot process forms a chain of trust by verifying all mutable software entities involved ...

urllib3 allows an unbounded number of links in the decompression chain

...

PT-2025-50537

Name of the Vulnerable Software and Affected Versions Meatmeet basestation devices with ESP32 system on a chip affected versions not specified Description The ESP32 system on a chip used in Meatmeet basestation devices lacks Secure Boot functionality. Secure Boot verifies the authenticity of...

CVE-2025-65829

The CVE concerns the ESP32 SoC used in Meatmeet basestation devices, where Secure Boot is absent. This breaks the chain of trust during the Application Startup Flow, allowing a physically proximate attacker to flash modified firmware and cause code execution at startup. The available connected do...

Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack

The Shai‑Hulud 2.0 supply chain attack represents one of the most significant cloud-native ecosystem compromises observed recently. Attackers maliciously modified hundreds of publicly available packages, targeting developer environments, continuous integration and continuous delivery CI/CD...

Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack

The Shai‑Hulud 2.0 supply chain attack represents one of the most significant cloud-native ecosystem compromises observed recently. Attackers maliciously modified hundreds of publicly available packages, targeting developer environments, continuous integration and continuous delivery CI/CD...