CVE-2026-7305

A weakness has been identified in Xuxueli xxl-job up to 3.3.2. The affected element is the function triggerJob of the file xxl-job-admin/src/main/java/com/xxl/job/admin/service/impl/XxlJobServiceImpl.java of the component trigger Endpoint. This manipulation of the argument addressList causes...

CVE-2026-7305

CVE-2026-7305 affects Xuxueli xxl-job up to 3.3.2, specifically the triggerJob function in XxlJobServiceImpl.java (trigger Endpoint). The issue arises from manipulating the argument addressList, leading to server-side request forgery (SSRF). It can be triggered remotely, and a public exploit repo...

CVE-2026-3465 Tuya App/SDK JSON Data Point denial of service

A vulnerability was determined in Tuya App and SDK 24.07.11 on Android. Affected by this vulnerability is an unknown functionality of the component JSON Data Point Handler. This manipulation of the argument cruisetime causes denial of service. Remote exploitation of the attack is possible. The...

CVE-2026-3465

A vulnerability was determined in Tuya App and SDK 24.07.11 on Android. Affected by this vulnerability is an unknown functionality of the component JSON Data Point Handler. This manipulation of the argument cruisetime causes denial of service. Remote exploitation of the attack is possible. The...

CVE-2025-9103

A vulnerability was detected in ZenCart 2.1.0. Affected by this vulnerability is an unknown functionality of the component CKEditor. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The real existenc...

Cross-site Scripting (XSS)

Overview zencart/zencart is an Open Source E-commerce Application Affected versions of this package are vulnerable to Cross-site Scripting XSS via the CKEditor component. An attacker can inject and execute unauthorized scripts by submitting crafted input as an authorized administrator. Note: The...

Malicious code in test-mlw2-cornu-doubt (npm)

The package test-mlw2-cornu-doubt was found to contain malicious code...

Malicious code in test-mlw2-ganja-doubt (npm)

The package test-mlw2-ganja-doubt was found to contain malicious code...

MAL-2025-35128 Malicious code in test-mlw2-cornu-doubt (npm)

The package test-mlw2-cornu-doubt was found to contain malicious code...

MAL-2025-35390 Malicious code in test-mlw2-ganja-doubt (npm)

The package test-mlw2-ganja-doubt was found to contain malicious code...

Sellers can get scammed too, and Joe goes off on a rant about imposter syndrome

Welcome to this week's edition of the Threat Source newsletter. Hello again my friends! Geez, it's been a year am I right? Lemons its February you say?! Oof. Imposter syndrome. You've heard the term I'm sure, but what is it? Basically: imposter syndrome is the persistent feeling of self-doubt and...

How helpful are estimates about how much cyber attacks cost?

Coming from the newspaper and media industry, Im no stranger to wanting to write catchy headlines. Im certainly at fault for throwing together a story about so-and-sos house sold for X million dollars. But recently Ive been wondering if those "big numbers" for cybersecurity are helpful at all, ev...

Announcing the $12k NIST Elliptic Curves Seeds Bounty

The NIST elliptic curves that power much of modern cryptography were generated in the late '90s by hashing seeds provided by the NSA. How were the seeds generated? Rumor has it that they are in turn hashes of English sentences, but the person who picked them, Dr. Jerry Solinas, passed away in ear...

Input validation

A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The manipulation of the argument spkt.buf/rpkt.buf leads to improper validation of array index. The real existence of this vulnerability is sti...

Wipermania: An All You Can Wipe Buffet

Wipermania: An All You Can Wipe Buffet By Trellix · November 15, 2022 This blog was written by Max Kersten In early 2022, Ukrainian companies were struck by multiple destructive wipers, attacking various organizations across sectors. This raised questions about the usage and impact of “digital...

Identifying cyberthreats quickly with proactive security testing

The security community is continuously changing, growing, and learning from each other to better position the world against cyberthreats. In the latest post of our Community Voices blog series, Microsoft Security Senior Product Marketing Manager Brooke Lynn Weenig talks with Matthew Hickey,...

On Conveying Doubt

This post was authored by Matt Olney.Typically, Talos has the luxury of time when conducting research. We can carefully draft a report that clearly lays out the evidence and leads the reader to a clear understanding of our well supported findings. A great deal of time is spent ensuring that the...

Separating the Paranoid from the Hacked

Sad story of someone whose computer became owned by a griefer: The trouble began last year when he noticed strange things happening: files went missing from his computer; his Facebook picture was changed; and texts from his daughter didn't reach him or arrived changed. "Nobody believed me," says...

Incredible! Someone Just Hacked 10,000 Routers to Make them More Secure

Has anyone ever heard about a "Vigilante-style Hacker," who hacks every possible system to make them more Secure? No. It's not funny, neither a movie story: Reportedly, someone is hacking thousands unprotected Wi-Fi routers everywhere and apparently forcing owners to make them more Secure. Securi...