CVE-2025-32875

An issue was discovered in the COROS application through 3.8.12 for Android. Bluetooth pairing and bonding is neither initiated nor enforced by the application itself. Also, the watch does not enforce pairing and bonding. As a result, any data transmitted via BLE remains unencrypted, allowing...

PT-2025-26322 · Coros · Coros Pace 3

Name of the Vulnerable Software and Affected Versions: COROS PACE 3 versions through 3.0808.0 Description: An issue was discovered that allows the COROS Pace 3 to download firmware files via HTTP when connected to a WLAN, but the communication is not encrypted. This lack of encryption enables...

CVE-2025-32880

An issue was discovered on COROS PACE 3 devices through 3.0808.0. It implements a function to connect the watch to a WLAN. With WLAN access, the COROS Pace 3 downloads firmware files via HTTP. However, the communication is not encrypted and allows sniffing and machine-in-the-middle attacks...

CVE-2025-32875

An issue was discovered in the COROS application through 3.8.12 for Android. Bluetooth pairing and bonding is neither initiated nor enforced by the application itself. Also, the watch does not enforce pairing and bonding. As a result, any data transmitted via BLE remains unencrypted, allowing...

CVE-2025-32880

The CVE-2025-32880 entry concerns COROS PACE 3 devices (through 3.0808.0) where WLAN-based firmware downloads occur over HTTP, unencrypted, enabling sniffing and man-in-the-middle attacks. Affected component is the WLAN firmware update/download flow; root cause is lack of encryption in the HTTP t...

CVE-2025-32880

An issue was discovered on COROS PACE 3 devices through 3.0808.0. It implements a function to connect the watch to a WLAN. With WLAN access, the COROS Pace 3 downloads firmware files via HTTP. However, the communication is not encrypted and allows sniffing and machine-in-the-middle attacks...

Malicious code in hackshack-leaderboard (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-5440 Malicious code in my-not-confused-packages (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 61a538815a196fdd5ba0751d871564ddee1dd8a5b285a933e28862c28faa25eb Any computer that has this package installed or running should be considered...

SUSE CVE-2022-50015

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot It is not yet clear, but it is possible to create a firmware so broken that it will send a reply message before a FWREADY message it is not yet clear if...

SUSE CVE-2025-38036

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Perform early GT MMIO initialization to read GMDID VFs need to communicate with the GuC to obtain the GMDID value and existing GuC functions used for that assume that the GT has it's MMIO members already setup. However...

CVE-2024-45208

The Versa Director SD-WAN orchestration platform which makes use of Cisco NCS application service. Active and Standby Directors communicate over TCP ports 4566 and 4570 to exchange High Availability HA information using a shared password. Affected versions of Versa Director bound to these ports o...

MAL-2025-5241 Malicious code in taskcluster-db (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 015560a72e308c3ba1770533176ac7fe0bcfbe4892581829992ee47063774f5c Any computer that has this package installed or running should be considered...

Malicious code in totallynotapaylaod (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in rival-fetch-hook (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in monpayload (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-5348 Malicious code in @exitman_ctf/steal (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in alexwilliam (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in calc_03kqnrbygi (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in @unkn0wnartist/h1-poc-test (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0e64d1dfdc7c6bafca9393b3ee87b5751283b6d3c2149f5f69e8579a500cda3 Any computer that has this package installed or running should be considered...

CVE-2022-50016

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot It is not yet clear, but it is possible to create a firmware so broken that it will send a reply message before a FWREADY message it is not yet clear if FWREADY...