CVE-2025-33079

Summary of CVE-2025-33079 (IBM Controller information disclosure) Affected products: IBM Controller: version 11.1.0 (and IBM Cognos Controller 11.0.0 – 11.0.1). Root cause / vulnerability: An authenticated user could obtain sensitive credentials that may be inadvertently included within the sourc...

MAL-2025-4446 Malicious code in osuny (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2a422d19cd1a77a3b8c8f23546a8b28a164d923cfef3b4fee3187c2bac2d8b19 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4146 Malicious code in @character-tech/client-common (npm)

--- -= Per source details. Do not edit below this line.=-...

⚡ Weekly Recap: Zero-Day Exploits, Insider Threats, APT Targeting, Botnets and More

Cybersecurity leaders aren't just dealing with attacks—they're also protecting trust, keeping systems running, and maintaining their organization's reputation. This week's developments highlight a bigger issue: as we rely more on digital tools, hidden weaknesses can quietly grow. Just fixing...

MAL-2025-3991 Malicious code in fanotify (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bad587097321dd0862dbb332c1103171c68338080d4f4a935afd9ed80f56ba3f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3870 Malicious code in api-doc-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4ed9c9d80a7285c6d9eab363f722cabd59b29f3239576a4562e6c881d6ad8899 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-21264

Files or directories accessible to external parties in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...

CVE-2025-21264 Visual Studio Code Security Feature Bypass Vulnerability

...

MAL-2025-3552 Malicious code in internal-payroll-lib-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38b57b13614231552ff2a81bd698a53edcac5cfcc943ef879a6a2e1de08d7fed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

AiXamine: Simplified LLM Safety and Security

Evaluating Large Language Models LLMs for safety and security remains a complex task, often requiring users to navigate a fragmented landscape of ad hoc benchmarks, datasets, metrics, and reporting formats. To address this challenge, we present aiXamine, a comprehensive black-box evaluation...

Access code - Moderately critical - Access bypass - SA-CONTRIB-2025-028

This module enables users to log in using a short access code instead of providing a username/password combination. The module doesn't sufficiently protect against brute force attacks to guess a user's access code. This vulnerability is mitigated by the fact that access code based logins are off ...

MAL-2025-1864 Malicious code in instacart-test (npm)

--- -= Per source details. Do not edit below this line.=-...

2025 State of Code Security: Key Trends and Risks

Explore the key insights on code and cloud security risks shaping 2025...

MAL-2025-1138 Malicious code in kiosk-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0cf98cf99dad32c045dfb31f81bc76a17bf67597b85b27273856761d7b3d31e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Updated phpmyadmin packages fix security vulnerabilities

fix possible security issue with library code slim/psr7 CVE-2023-30536 fix possible security issue relating to iconv CVE-2024-2961, PMASA-2025-3 fix an XSS vulnerability in the check tables feature PMASA-2025-1 fix an XSS vulnerability in the Insert tab PMASA-2025-2...

Vulnerabilities-Proofs-of-Concept

Vulnerabilities Proofs-of-Concept This repository hosts proof...

Security update for postgresql14

This update for postgresql14 fixes the following issues: CVE-2024-10976: Ensure cached plans are marked as dependent on the calling role when RLS applies to a non-top-level table reference bsc1233323. CVE-2024-10977: Make libpq discard error messages received during SSL or GSS protocol negotiatio...

KLA77062 Multiple vulnerabilities in Google Chrome

Multiple vulnerabilities were found in Google Chrome. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code, bypass security restrictions. Below is a complete list of vulnerabilities: 1. Inappropriate implementation vulnerability in Blink can be...

CVE-2024-47878 Reflected cross-site scripting vulnerability (XSS) in GData extension (authorized.vt)

OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the /extension/gdata/authorized endpoint includes the state GET parameter verbatim in a tag in the output, so without escaping. An attacker could lead or redirect a user to a crafted URL containing...

MAL-2024-11672 Malicious code in pydllcfg (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 94960ddaf12ee1269aaab9abf1893d320ae2ff50fbd17ff4773edab18e7e3a11 Importing a module starts downloading and executing an infostealer, widely identified by AV/sandboxes. --- Category: MALICIOUS - The campaign has clearly...