EUVD-2025-16018

Malicious code in bioql PyPI...

EUVD-2025-19734

Malicious code in bioql PyPI...

EUVD-2023-2728

Malicious code in bioql PyPI...

A Statistical Method for Attack-Agnostic Adversarial Attack Detection with Compressive Sensing Comparison

Adversarial attacks present a significant threat to modern machine learning systems. Yet, existing detection methods often lack the ability to detect unseen attacks or detect different attack types with a high level of accuracy. In this work, we propose a statistical approach that establishes a...

FalseCrashReducer: Mitigating False Positive Crashes in OSS-Fuzz-Gen Using Agentic AI

Fuzz testing has become a cornerstone technique for identifying software bugs and security vulnerabilities, with broad adoption in both industry and open-source communities. Directly fuzzing a function requires fuzz drivers, which translate random fuzzer inputs into valid arguments for the target...

Improper Validation of Specified Quantity in Input

Overview torch is a Tensors and Dynamic neural networks in Python with strong GPU acceleration Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input in the ModularIndexing function when Inductor config is set to constantandindexpropagation=False. A...

CVE-2025-39886 bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init()

In the Linux kernel, the following vulnerability has been resolved: bpf: Tell memcg to use allowspinning=false path in bpftimerinit Currently, calling bpfmapkmallocnode from bpfasyncinit can cause various locking issues; see the following stack trace edited for style as one example: ... 10.011566...

Synergizing Static Analysis with Large Language Models for Vulnerability Discovery and Beyond

This report examines the synergy between Large Language Models LLMs and Static Application Security Testing SAST to improve vulnerability discovery. Traditional SAST tools, while effective for proactive security, are limited by high false-positive rates and a lack of contextual understanding...

The vulnerability of Microsoft Edge browser for Android, related to the false representation of critical information on the user interface, allows attackers to perform spear-phishing attacks.

The vulnerability of Microsoft Edge browser for Android is related to the user interface’s false representation of critical information. Exploiting this vulnerability allows a remote attacker to perform spear-phishing attacks...

VulAgent: Hypothesis-Validation Based Multi-Agent Vulnerability Detection

The application of language models to project-level vulnerability detection remains challenging, owing to the dual requirement of accurately localizing security-sensitive code and correctly correlating and reasoning over complex program context. We present VulAgent, a multi-agent vulnerability...

SUSE CVE-2025-39762

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: add null check WHY Prevents null pointer dereferences to enhance function robustness HOW Adds early null check and return false if invalid...

A Kolmogorov-Arnold Network for Interpretable Cyberattack Detection in AGC Systems

Automatic Generation Control AGC is essential for power grid stability but remains vulnerable to stealthy cyberattacks, such as False Data Injection Attacks FDIAs, which can disturb the system's stability while evading traditional detection methods. Unlike previous works that relied on blackbox...

A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.

...

CVE-2025-54588 Envoy: Race condition in Dynamic Forward Proxy leads to use-after-free and segmentation faults

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. Versions 1.34.0 through 1.34.4 and 1.35.0 contain a use-after-free UAF vulnerability in the DNS cache, causing abnormal process termination. The vulnerability is in Envoy's Dynamic...

The vulnerability of Mozilla Firefox browsers, related to the false representation of critical information to the user interface, allows attackers to compromise the integrity of the protected information.

The vulnerability of Mozilla Firefox browsers is related to the false representation of critical information to the user’s interface. Exploiting this vulnerability can allow a malicious actor to compromise the integrity of the protected information...

The vulnerability of Mozilla Firefox browsers, related to the false representation of critical information to the user interface, allows attackers to compromise the integrity of the protected information.

The vulnerability of Mozilla Firefox browsers is related to the false representation of critical information to the user’s interface. Exploiting this vulnerability can allow a malicious actor to compromise the integrity of the protected information...

Why SIEM Rules Fail and How to Fix Them: Insights from 160 Million Attack Simulations

Security Information and Event Management SIEM systems act as the primary tools for detecting suspicious activity in enterprise networks, helping organizations identify and respond to potential attacks in real time. However, the new Picus Blue Report 2025 , based on over 160 million real-world...

Nuclei 3.4.10

Nuclei is a modern, high-performance vulnerability scanner that leverages simple YAML-based templates. It empowers you to design custom vulnerability detection scenarios that mimic real-world conditions, leading to zero false positives...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from mac80211 issuing a false warning about the monitor mode interface on certain devices...

Linux Distros Unpatched Vulnerability : CVE-2018-13420

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Google gperftools 2.7 has a memory leak in mallocextension.cc, related to MallocExtension::Register and InitModule. NOTE: the software maintainer indicates that...