EUVD-2025-30276

Malicious code in bioql PyPI...

EUVD-2024-0614

Malicious code in bioql PyPI...

PT-2025-38603

Name of the Vulnerable Software and Affected Versions General Bytes Crypto Application Server CAS versions 20201208 through 20220531.38 General Bytes Crypto Application Server CAS version 20220725.22 Description General Bytes Crypto Application Server CAS contains an authentication bypass in the...

CVE-2025-8699

Some "Stored Value" Unattended Payment Solutions of KioSoft use vulnerable NFC cards. Attackers could potentially use this vulnerability to change the balance on the cards and generate money. The account balance is stored on an insecure MiFare Classic NFC card and can be read and written back. By...

Embedded Malicious Code

Overview duckdb is a Node.js API for DuckDB, the "SQLite for Analytics". The API for this client is somewhat compliant to the SQLite Node.js client for easier transition and transition you must eventually. Affected versions of this package are vulnerable to Embedded Malicious Code. This package...

Embedded Malicious Code

Overview @duckdb/node-api is an API for using DuckDB in Node. Affected versions of this package are vulnerable to Embedded Malicious Code. This package version contains malicious code that monitors network traffic when run in a browser and targets crypto transactions. The injected malicious code...

Embedded Malicious Code

Overview proto-tinker-wc is a prototype app written in Stencil and Tailwind, deployed via NPM and Vercel. Affected versions of this package are vulnerable to Embedded Malicious Code. This package version contains malicious code that monitors network traffic when run in a browser and targets crypt...

Operation Serengeti 2.0: Trend Micro Helps Law Enforcement Fight Cybercrime in Africa

Operation Serengeti 2.0: With Trend Micro’s support, INTERPOL led a major crackdown across Africa, arresting cybercriminals, dismantling infrastructures, recovering illicit funds, and protecting tens of thousands of victims...

Malicious Package

Overview bittenso is a malicious package. This package contains malicious code, and its content was removed from the official package manager. The package appears to be part of a typosquatting campaign targeting the Bittensor ecosystem. The goal of the attackers is to steal cryptocurrency from...

U.S. Dept Of Defense: Cross-Site Scripting via 'RAISED_FUNDS_DESC' parameter

A Cross-Site Scripting XSS vulnerability was discovered in the parameter 'RAISEDFUNDSDESC' through the POST method on the target website. Exploitation of this vulnerability could have led to consequences such as cookie theft and session hijacking. The vendor was notified, and appropriate...

Over 20 Malicious Apps on Google Play Target Users for Seed Phrases

Over 20 malicious apps on Google Play are stealing crypto seed phrases by posing as trusted wallets and exchanges, putting users' funds at risk...

CVE-2025-24800

Hyperbridge is a hyper-scalable coprocessor for verifiable, cross-chain interoperability. A critical vulnerability was discovered in the ismp-grandpa crate, that allowed a malicious prover easily convince the verifier of the finality of arbitrary headers. This could be used to steal funds or...

CVE-2024-30470

Missing Authorization vulnerability in YITH YITH WooCommerce Account Funds Premium.This issue affects YITH WooCommerce Account Funds Premium: from n/a through 1.33.0...

CVE-2023-30543

@web3-react is a framework for building Ethereum Apps . In affected versions the chainId may be outdated if the user changes chains as part of the connection flow. This means that the value of chainId returned by useWeb3React may be incorrect. In an application, this means that any data derived...

CVE-2023-42449

Hydra is the two-layer scalability solution for Cardano. Prior to version 0.13.0, it is possible for a malicious head initializer to extract one or more PTs for the head they are initializing due to incorrect data validation logic in the head token minting policy which then results in an flawed...

CVE-2021-41592

Blockstream c-lightning through 0.10.1 allows loss of funds because of dust HTLC exposure...

Insufficient Visual Distinction of Homoglyphs Presented to User

Overview org.webjars.npm:base-x is a Fast base encoding / decoding of any given alphabet Affected versions of this package are vulnerable to Insufficient Visual Distinction of Homoglyphs Presented to User through the validation process. An attacker can deceive users into sending funds to an...

GHSA-XQ7P-G2VC-G82P Homograph attack allows Unicode lookalike characters to bypass validation.

Impact Attackers can deceive users into sending funds to an unintended address. Patches https://github.com/cryptocoinjs/base-x/pull/86...

base-x 安全漏洞

base-x is a cryptocoinjs open source tool for encoding/decoding any base. A security vulnerability exists in base-x versions prior to 3.0.11, 4.0.0, and 5.0.0, which stems from a vulnerability that could cause a user to send funds to an unintended address...

OPC cardsystems Webapp Aufwertung 安全漏洞

OPC cardsystems Webapp Aufwertung is a billing system from OPC cardsystems, Inc. A security vulnerability exists in OPC cardsystems Webapp Aufwertung version 2.1.0 that stems from a transaction reference that can be reused, potentially resulting in an improper transfer of funds...