Backdoors in Python and NPM Packages Target Windows and Linux

Checkmarx uncovers cross-ecosystem attack: fake Python and NPM packages plant backdoor on Windows and Linux, enabling data theft plus remote control...

An Accurate and Efficient Vulnerability Propagation Analysis Framework

Identifying the impact scope and scale is critical for software supply chain vulnerability assessment. However, existing studies face substantial limitations. First, prior studies either work at coarse package-level granularity, producing many false positives, or fail to accomplish whole-ecosyste...

DNN < 9.13.9 DotNetNuke.Core Multiple Vulnerabilities

According to its self-reported version, the instance of DNN formerly DotNetNuke running on the remote web server is prior to 9.13.9. It is, therefore, affected by multiple vulnerabilities: - DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem...

CVE-2025-48377

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. Prior to version 9.13.9, a specially crafted URL may be constructed which can inject an XSS payload that is triggered by using some module actions. Version 9.13.9 fixes the issue...

CVE-2024-5445

Ecosystem Agent version 4 4.1.5.2597 and Ecosystem Agent version 5 5.1.4.2473 did not properly validate SSL/TLS certificates, which could allow a malicious actor to perform a Man-in-the-Middle and intercept traffic between the agent and N-able servers from a privileged network position...

@adebaraayomide/synchro_sdk (>=0.0.3, <=0.1.0-synchro-sdk), @aloe2/abstract-eth (1.0.20228282226) +271 more potentially affected by CVE-2025-47934 via openpgp (>=5.0.1, <=5.11.2)

openpgp NPM version =5.0.1, =0.0.3, =0.1.0-synchro-sdk - @aloe2/abstract-eth 1.0.20228282226 - @aloe2/abstract-utxo 1.1.20228282226 - @aloe2/account-lib 2.20.20228282226 - @aloe2/bitgo 14.2.20228282226 - @aloe2/sdk-api 1.1.20228282226 - @aloe2/sdk-coin-ada 1.1.20228282226 - @aloe2/sdk-coin-algo...

ux 跨站脚本漏洞

ux is a Symfony open source JavaScript ecosystem for Symfony. A cross-site scripting vulnerability exists in versions of ux prior to 2.25.1, which stems from unescaped attribute values and could lead to HTML attribute injection and cross-site scripting attacks...

MPMA: Preference Manipulation Attack against Model Context Protocol

Model Context Protocol MCP standardizes interface mapping for large language models LLMs to access external data and tools, which revolutionizes the paradigm of tool selection and facilitates the rapid expansion of the LLM agent tool ecosystem. However, as the MCP is increasingly adopted,...

[SECURITY] Fedora 41 Update: golang-github-nats-io-nkeys-0.4.11-2.fc41

A public-key signature system based on Ed25519 for the NATS ecosystem...

[SECURITY] Fedora 42 Update: golang-github-nats-io-nkeys-0.4.11-2.fc42

A public-key signature system based on Ed25519 for the NATS ecosystem...

Engineering Risk-Aware, Security-By-Design Frameworks for Assurance of Large-Scale Autonomous AI Models

As AI models scale to billions of parameters and operate with increasing autonomy, ensuring their safe, reliable operation demands engineering-grade security and assurance frameworks. This paper presents an enterprise-level, risk-aware, security-by-design approach for large-scale autonomous AI...

a3mo_lib (>=0.1.0, <=0.1.1), abra (0.0.1) +4425 more potentially affected by unknown CVE via rustc-serialize (>=0.1.5, <=0.3.25)

rustc-serialize CARGO version =0.1.5, =0.1.0, =0.1.7, =0.2.0-beta.4, =0.0.6, =0.1.0, =0.2.1, =0.1.4, =0.1.1, =0.1.0, =0.9.0, =0.1.0, =0.3.3, =0.5.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0025...

alloy-rs (0.2.1), anndata (0.2.0) +112 more potentially affected by unknown CVE via arrow2 (>=0.5.3, <=0.18.0)

arrow2 CARGO version =0.5.3, =0.1.0, =0.1.0, =0.6.0, =0.1.0, =0.0.1, =0.1.0, =0.2.1, =0.2.2, =0.4.0, =0.1.0, =0.1.0, =0.1.4 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0038...

Darcula Adds GenAI to Phishing Toolkit, Lowering the Barrier for Cybercriminals

The threat actors behind the Darcula phishing-as-a-service PhaaS platform have released new updates to their cybercrime suite with generative artificial intelligence GenAI capabilities. "This addition lowers the technical barrier for creating phishing pages, enabling less tech-savvy criminals to...

aabb_physics (>=0.1.0, <=0.1.1), acolor (>=0.0.2, <=0.0.11) +118 more potentially affected by unknown CVE via macroquad (>=0.2.9, <=0.4.16)

macroquad CARGO version =0.2.9, =0.1.0, =0.0.2, =0.1.0, =0.1.0, =0.1.0, =0.0.4, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.3 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0035...

A Time Series Analysis of Malware Uploads to Programming Language Ecosystems

Software ecosystems built around programming languages have greatly facilitated software development. At the same time, their security has increasingly been acknowledged as a problem. To this end, the paper examines the previously overlooked longitudinal aspects of software ecosystem security,...

CVE Program Almost Unfunded

Mitre's CVE's program--which provides common naming and other informational resources about cybersecurity vulnerabilities--was about to be cancelled, as the US Department of Homeland Security failed to renew the contact. It was funded for eleven more months at the last minute. This is a big deal...

[SECURITY] Fedora 42 Update: matrix-synapse-1.127.1-1.fc42

Matrix is an ambitious new ecosystem for open federated Instant Messaging and VoIP. Synapse is a reference "homeserver" implementation of Matrix from the core development team at matrix.org, written in Python/Twisted. It is intended to showcase the concept of Matrix and let folks see the spec in...

CVE-2025-32373

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. In limited configurations, registered users may be able to craft a request to enumerate/access some portal files they should not have access to. This vulnerability is fixed in 9.13.8...

CVE-2025-32374

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. Possible denial of service with specially crafted information in the public registration form. This vulnerability is fixed in 9.13.8...