PT-2025-38546

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The batadv nc skb decode packet function in the batman-adv module does not properly validate the coded len variable, potentially leading to out-of-bounds read and write issues during...

CVE-2025-39839: Out-of-bounds Read

In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix OOB read/write in network-coding decode batadvncskbdecodepacket trusts codedlen and checks only against skb-len. XOR starts at sizeofstruct batadvunicastpacket, reducing payload headroom, and the source skb length...

SQLInjectionWiki

This is a SQL injection wiki repository. It is a collection of resources and information on SQL injection techniques, including detection, exploitation, and mitigation. The repository is maintained by NetSPI and is available in both English and Chinese versions. The wiki covers various topics...

USN-7738-1 ffmpeg vulnerability

It was discovered that FFmpeg incorrectly handled the calculation of LPC order, which could lead to a stack-based buffer overflow. An attacker could possibly use this issue to cause FFmpeg to crash, resulting in a denial of service...

Claude AI chatbot abused to launch “cybercrime spree”

Anthropic—the company behind the widely renowned coding chatbot, Claude—says it uncovered a large-scale extortion operation in which cybercriminals abused Claude to automate and orchestrate sophisticated attacks. The company issued a Threat Intelligence report in which it describes several...

CVE-2025-54032

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WebCodingPlace Real Estate Manager Pro real-estate-manager-pro allows Reflected XSS.This issue affects Real Estate Manager Pro: from n/a through = 12.7.3...

CVE-2025-54032

CVE-2025-54032 is a reflected XSS in the WordPress plugin Real Estate Manager Pro (versions up to 12.7.3). The root cause is improper input neutralization during web page generation, enabling an attacker-controlled input to be reflected in the page. The CVSS v3.1 base score is 7.1 (High); attack ...

OSV-2025-614 Heap-buffer-overflow in hevc_hvcC_to_AnnexB_NAL

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=437694936 Crash type: Heap-buffer-overflow WRITE Crash state: hevchvcCtoAnnexBNAL Open genericstart...

Webinar: How to Stop Python Supply Chain Attacks—and the Expert Tools You Need

Python is everywhere in modern software. From machine learning models to production microservices, chances are your code—and your business—depends on Python packages you didn't write. But in 2025, that trust comes with a serious risk. Every few weeks, we're seeing fresh headlines about malicious...

CVE-2025-4684: Improper Neutralization of Input During Web Page Generation

The BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Imports, No Coding Needed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML attributes of Image Carousel and Image...

Wiz Uncovers Critical Access Bypass Flaw in AI-Powered Vibe Coding Platform Base44

Cybersecurity researchers have disclosed a now-patched critical security flaw in a popular vibe coding platform called Base44 that could allow unauthorized access to private applications built by its users. "The vulnerability we discovered was remarkably simple to exploit -- by providing only a...

Wiz Research Uncovers Critical Vulnerability in AI Vibe Coding platform Base44 Allowing Unauthorized Access to Private Applications

New discovery underscores security implications of AI-powered development and the rise of Vibe Coding Platforms...

Secure Coding for Web Applications: Frameworks, Challenges, and the Role of LLMs

Secure coding is a critical yet often overlooked practice in software development. Despite extensive awareness efforts, real-world adoption remains inconsistent due to organizational, educational, and technical barriers. This paper provides a comprehensive review of secure coding practices across...

PT-2025-30619 · Robocode · Robocode

Name of the Vulnerable Software and Affected Versions: Roo Code versions 3.23.18 and below Description: Roo Code, an AI-powered autonomous coding agent, does not validate line breaks in its command input. This bypasses the allow-list mechanism due to a lack of parsing or validation logic,...

When Developer Aid Becomes Security Debt: a Systematic Analysis of Insecure Behaviors in LLM Coding Agents

LLM-based coding agents are rapidly being deployed in software development, yet their security implications remain poorly understood. These agents, while capable of accelerating software development, may inadvertently introduce insecure practices. We conducted the first systematic security...

CVE-2025-53536

Roo Code is an AI-powered autonomous coding agent. Prior to 3.22.6, if the victim had "Write" auto-approved, an attacker with the ability to submit prompts to the agent could write to VS Code settings files and trigger code execution. There were multiple ways to achieve that. One example is with...

CVE-2025-53536

Roo Code (AI-powered autonomous coding agent) prior to version 3.22.6 is affected. If a victim had the Write auto-approved mode, an attacker who can submit prompts could write to VS Code settings files and trigger code execution. A concrete example is the php.validate.executablePath setting, wher...

CVE-2025-6274 WebAssembly wabt binary-reader-interp.cc OnDataCount resource consumption

A vulnerability was found in WebAssembly wabt up to 1.0.37. It has been classified as problematic. Affected is the function OnDataCount of the file src/interp/binary-reader-interp.cc. The manipulation leads to resource consumption. Attacking locally is a requirement. The exploit has been disclose...

Secure Vibe Coding: The Complete New Guide

DALL-E for coders? That's the promise behind vibe coding, a term describing the use of natural language to create software. While this ushers in a new era of AI-generated code, it introduces "silent killer" vulnerabilities: exploitable flaws that evade traditional security tools despite perfect...

CVE-2022-50066

In the Linux kernel, the following vulnerability has been resolved: net: atlantic: fix aqvec index out of range error The final update statement of the for loop exceeds the array range, the dereference of self-aqveci is not checked and then leads to the index out of range error. Also fixed this...