Threat Exposure as a Narrative: If Attackers Tell a Story, Why Don’t We?

Running short on time but still want to stay in the know? Well, we’ve got you covered! We’ve condensed all the key takeaways into a handy audio summary. Our AI-driven podcasts are fit for on the go. Security teams are losing the communication battle to cybercriminals who intuitively understand...

Malicious code in title-dependencies (npm)

The package communicates with a domain associated with malicious activity...

CVE-2025-27457

All communication between the VNC server and clients is unencrypted. This allows an attacker to intercept the traffic and obtain sensitive data...

CVE-2025-27458

The VNC authentication mechanism bases on a challenge-response system where both server and client use the same password for encryption. The challenge is sent from the server to the client, is encrypted by the client and sent back. The server does the same encryption locally and if the responses...

CVE-2025-27458 CVE-2025-27458

The VNC authentication mechanism bases on a challenge-response system where both server and client use the same password for encryption. The challenge is sent from the server to the client, is encrypted by the client and sent back. The server does the same encryption locally and if the responses...

CVE-2025-27458

The CVE-2025-27458 entry concerns Endress+Hauser MEAC300-FNADE4. The vulnerability stems from a VNC-style authentication mechanism that uses a challenge-response system with the same password for encryption on both server and client. Because VNC traffic is unencrypted, an attacker who can observe...

CVE-2025-27458 CVE-2025-27458

The VNC authentication mechanism bases on a challenge-response system where both server and client use the same password for encryption. The challenge is sent from the server to the client, is encrypted by the client and sent back. The server does the same encryption locally and if the responses...

CVE-2025-27457 CVE-2025-27457

All communication between the VNC server and clients is unencrypted. This allows an attacker to intercept the traffic and obtain sensitive data...

CVE-2025-27457

CVE-2025-27457 concerns unencrypted communications between the VNC server and client(s) as stated in the NVD entry. Connected documents describe the same issue in the Endress+Hauser MEAC300-FNADE4 (CNVD/CNNVD/PT security pages), indicating traffic interception could reveal sensitive data. The pri...

CVE-2025-27457 CVE-2025-27457

All communication between the VNC server and clients is unencrypted. This allows an attacker to intercept the traffic and obtain sensitive data...

DEBIAN-CVE-2025-38102

In the Linux kernel, the following vulnerability has been resolved: VMCI: fix race between vmcihostsetupnotify and vmcictxunsetnotify During our test, it is found that a warning can be trigger in trygrabfolio as follow: ------------ cut here ------------ WARNING: CPU: 0 PID: 1678 at mm/gup.c:147...

MAL-2025-5591 Malicious code in show-dependencies (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7ffc4fb420d4b6a7508fa65da3a3695af74f01732f92bf8a4beaac80d16c1985 The OpenSSF Package Analysis project identified 'show-dependencies' @...

PT-2025-27779 · Unknown · Meac300-Fnade4

Name of the Vulnerable Software and Affected Versions: MEAC300-FNADE4 affected versions not specified Description: The issue concerns the absence of the Secure attribute on multiple cookies provided by the MEAC300-FNADE4. This allows an attacker to trick a user into establishing an unencrypted HT...

PT-2025-27787 · Vnc · Vnc

Name of the Vulnerable Software and Affected Versions: VNC affected versions not specified Description: The issue concerns the VNC authentication mechanism, which uses a challenge-response system. This system relies on both the server and client using the same password for encryption. An attacker...

PT-2025-27786 · Endress+Hauser · Endress+Hauser Meac300-Fnade4

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue concerns unencrypted communication between a server and clients, allowing an attacker to intercept traffic and obtain sensitive data. Recommendations: At the moment, there is no...

Malicious code in k6-studio (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7b163d493761fa12ed8094157415651ec1b22824f021a7483637346825e08cca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @frontend-clients/core (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 09d9aaa390d29f17fb6be0a0f730c5806ca1179876940237e6319d1378d0fbd3 Any computer that has this package installed or running should be considered...

MAL-2025-5536 Malicious code in @frontend-clients/core (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 09d9aaa390d29f17fb6be0a0f730c5806ca1179876940237e6319d1378d0fbd3 Any computer that has this package installed or running should be considered...

MAL-2025-5534 Malicious code in grafana-pyroscope (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 60f047f0a854cfa17b3119b25caf2e1a95069686aa77470689c2cfb55cddf1e0 Any computer that has this package installed or running should be considered...

Malicious code in cmr-stac (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe08a482b6fd733ff90ca659985e349edbc6676e0fc5b08d34a1bbdc825075c3 Any computer that has this package installed or running should be considered...