CVE-2025-21930

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: don't try to talk to a dead firmware This fixes: bad state = 0 WARNING: CPU: 10 PID: 702 at drivers/net/wireless/inel/iwlwifi/iwl-trans.c:178 iwltranssendcmd+0xba/0xe0 iwlwifi Call Trace: ? warn+0xca/0x1c0 ?...

Lucid PhaaS Hits 169 Targets in 88 Countries Using iMessage and RCS Smishing

A new sophisticated phishing-as-a-service PhaaS platform called Lucid has targeted 169 entities in 88 countries using smishing messages propagated via Apple iMessage and Rich Communication Services RCS for Android. Lucid's unique selling point lies in its weaponizing of legitimate communication...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an attempt to communicate with dead firmware...

The vulnerability of the digital_in_send_sdd_req() function in the net/nfc/digital_technology.c module of the NFC subsystem of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the digitalinsendsddreq function in the net/nfc/digitaltechnology.c module of the NFC subsystem of the Linux operating system is related to improper memory release before deleting the last pointer memory leak. Exploiting this vulnerability could allow an attacker to cause a...

The vulnerability of the SAP Web Dispatcher web dispatcher and the SAP NetWeaver Internet Communication Manager web application servers involves the disclosure of password values in log files, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the SAP Web Dispatcher web dispatcher and the SAP NetWeaver Internet Communication Manager web application servers relates to the disclosure of password values in log files. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized...

MAL-2025-3022 Malicious code in pocketnet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 73c905c72824fcd244dfaaa2732a81deabf6f59b88d5c95e9d513fd1dd8f5a22 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @sas-dvr/nova-crossorigin-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f1c862311f1c77bb8bff4654f153e9035315f16804a207d72efd9f06d5d35aaf The OpenSSF Package Analysis project identified '@sas-dvr/nova-crossorigin-auth' @ 132.0.0 npm as malicious. It is considered malicious because:...

MAL-2025-2806 Malicious code in @sas-dvr/nova-crossorigin-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f1c862311f1c77bb8bff4654f153e9035315f16804a207d72efd9f06d5d35aaf The OpenSSF Package Analysis project identified '@sas-dvr/nova-crossorigin-auth' @ 132.0.0 npm as malicious. It is considered malicious because:...

The vulnerability of Mozilla Firefox’s inter-process communication mechanism allows a hacker to bypass existing security restrictions and execute arbitrary code.

The vulnerability of Mozilla Firefox’s inter-process communication mechanism is related to incorrect handling of descriptors. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions and execute arbitrary code...

About the security content of AirPlay audio SDK 2.7.1, AirPlay video SDK 3.6.0.126, and CarPlay Communication Plug-in R18.1 Updates

About the security content of AirPlay audio SDK 2.7.1, AirPlay video SDK 3.6.0.126, and CarPlay Communication Plug-in R18.1 Updates This document is intended for developers of accessories or software compatible with Apple devices. These updates are available for members of the Apple MFi Program...

Malicious code in web-commerce-hook (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3db0dcb1f890e4ce0fdf79bcdd216d419d1bdcefb1cac333858a78b0d7efa3ca The OpenSSF Package Analysis project identified 'web-commerce-hook' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2025-2799 Malicious code in sony-liv-smarttv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 61696a41d9c61203ebde9adcecf521e954619c6273e75d9da24c9f402aaeb603 The OpenSSF Package Analysis project identified 'sony-liv-smarttv' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2025-2797 Malicious code in careform (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d7248630d858215437792791bab0fa4a0e67e7a614e29fe427c829e371c5a5bc The OpenSSF Package Analysis project identified 'careform' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in rippling-marketing-site (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 33a7126a0a4c766d46bba75737e5f330267038f14b6006030e92fc55e076d658 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bugbounty208-test-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5012a09f4c2283a7df00a99f643af1a87adbef671a39e6569188a3bcdced87e8 The OpenSSF Package Analysis project identified 'bugbounty208-test-package' @ 1.0.1 npm as malicious. It is considered malicious because: - The...

Mozilla Patches Critical Firefox Bug Similar to Chrome's Recent Zero-Day Vulnerability

Mozilla has released updates to address a critical security flaw impacting its Firefox browser for Windows, merely days after Google patched a similar flaw in Chrome that came under active exploitation as a zero-day. The security vulnerability, CVE-2025-2857, has been described as a case of an...

MAL-2025-2733 Malicious code in @johndeere-tech/helios-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 99b3379997f7c1fa963e3f0022064669ccae41425799fd8d62cbcda0d2d01651 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @johndeere-tech/helios-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 99b3379997f7c1fa963e3f0022064669ccae41425799fd8d62cbcda0d2d01651 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-2857

Following the recent Chrome sandbox escape CVE-2025-2783, various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape. The original vulnerability was...

CVE-2024-12169

A vulnerability exists in RTU500 IEC 60870-5-104 controlled station functionality and IEC 61850 functionality, that allows an attacker performing a specific attack sequence to restart the affected CMU. This vulnerability only applies, if secure communication using IEC 62351-3 TLS is enabled...