10878 matches found
It's a Feature, Not a Bug: Secure and Auditable State Rollback for Confidential Cloud Applications
Replay and rollback attacks threaten cloud application integrity by reintroducing authentic yet stale data through an untrusted storage interface to compromise application decision-making. Prior security frameworks mitigate these attacks by enforcing forward-only state transitions state continuit...
Your passport, now on your iPhone. Helpful or risky?
Apple has launched Digital ID, a way for users in the US to create and present a government-issued ID in Apple Wallet using their passport information. For now, it works only for identity verification at Transportation Security Administration TSA checkpoints in more than 250 airports. Apple says...
CVE-2025-55073 MS Teams plugin OAuth allows editing arbitrary posts
Mattermost versions 10.11.x = 10.11.3, 10.5.x = 10.5.11, 10.12.x = 10.12.0 fail to validate the relationship between the post being updated and the MSTeams plugin OAuth flow which allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL...
Finding Software Supply Chain Attack Paths with Logical Attack Graphs
Cyberattacks are becoming increasingly frequent and sophisticated, often exploiting the software supply chain SSC as an attack vector. Attack graphs provide a detailed representation of the sequence of events and vulnerabilities that could lead to a successful security breach in a system. MulVal ...
CKEditor <= 46.1.0 Reflected XSS Vulnerability
CKEditor 5 is prone to a reflected cross-site scripting XSS vulnerability when used with Angular. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-on...
BreachLock and Vanta Bridge the Gap Between Continuous Security Testing and Compliance with New Integration
New York, New York, 13th November 2025, CyberNewsWire...
EUVD-2025-175598
Malicious code in webdriverio-jasmine-dione-perseus npm...
EUVD-2025-175581
Malicious code in websockets-hawkingradiation-redis-barnard npm...
EUVD-2025-180493
Malicious code in aether-quantum-computing-koa-xanadu npm...
PYSEC-2025-112
DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator pcg32 to generate cryptographic keys or...
CVE-2025-12633
The Booking Calendar | Appointment Booking | Bookit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/bookit/v1/commerce/stripe/return' REST API Endpoint in all versions up to, and including, 2.5.0. This makes it possible fo...
EUVD-2025-114854
Malicious code in cross-env-geckodriver-pino-pretty-nightwatch npm...
EUVD-2025-114451
Malicious code in docusaurus-cressida-vuetify-cz-conventional-changelog npm...
EUVD-2025-116301
Malicious code in await-markdownlint-axios-child-process npm...
Malicious code in browserify-meteor-exec-jsonp (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 122e7097b25471597433a406c160c80c2b71d0f76c3ef49421322f2d34b31c6d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-114396
Malicious code in dotenv-parse-variables-convict-fusion-vuepress npm...
EUVD-2025-122243
Malicious code in sass-loader-nightwatch-await-hermes npm...
EUVD-2025-111568
Malicious code in loopback-firebase-postgres-luna npm...