GHSA-WFQV-66VQ-46RM Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped

Summary When verifying artifact signatures using a certificate, Cosign first verifies the certificate chain using the leaf certificate's "not before" timestamp and later checks expiry of the leaf certificate using either a signed timestamp provided by the Rekor transparency log or from a timestam...

Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped

Summary When verifying artifact signatures using a certificate, Cosign first verifies the certificate chain using the leaf certificate's "not before" timestamp and later checks expiry of the leaf certificate using either a signed timestamp provided by the Rekor transparency log or from a timestam...

GHSA-X5M4-43JF-HH65 soroban-fixed-point-math has Incorrect Rounding and Overflow Handling in Signed Fixed-Point Math with Negatives

Impact Incorrect rounding direction for signed mul and div operations The mulDivx, y, z function incorrectly handled cases where both the intermediate product $x y$ and the divisor $z$ were negative. The logic assumed that if the intermediate product was negative, the final result must also be...

CVE-2021-47898

Epson USB Display 1.6.0.0 contains an unquoted service path vulnerability in the EMPUDSA service running with LocalSystem privileges. Attackers can exploit the unquoted path by placing malicious executables in intermediate directories to gain elevated system access...

MiracleLinux 4 : nspr-4.10.2-1.AXS4, nss-3.15.3-6.0.1.AXS4, nss-util-3.15.3-1.AXS4 (AXSA:2014-054:01)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2014-054:01 advisory. nss: Network Security Services NSS is a set of libraries designed to support cross-platform development of security-enabled client and server...

Static Detection of Core Structures in Tigress Virtualization-Based Obfuscation Using an LLVM Pass

Malware often uses obfuscation to hinder security analysis. Among these techniques, virtualization-based obfuscation is particularly strong because it protects programs by translating original instructions into attacker-defined virtual machine VM bytecode, producing long and complex code that is...

CVE-2025-25176

Intermediate register values of secure workloads can be exfiltrated in workloads scheduled from applications running in the non-secure environment of a platform...

CVE-2025-25176 GPU DDK - GPU Register value contents leaked from secure workloads to non-secure world

Intermediate register values of secure workloads can be exfiltrated in workloads scheduled from applications running in the non-secure environment of a platform...

CVE-2025-25176: Exposure of Resource to Wrong Sphere

Intermediate register values of secure workloads can be exfiltrated in workloads scheduled from applications running in the non-secure environment of a platform...

RulePilot: An LLM-Powered Agent for Security Rule Generation

The real-time demand for system security leads to the detection rules becoming an integral part of the intrusion detection life-cycle. Rule-based detection often identifies malicious logs based on the predefined grammar logic, requiring experts with deep domain knowledge for rule generation...

EUVD-2025-104479

Malicious code in intermediateminkz3n npm...

EUVD-2025-104478

Malicious code in intermediateratz3n npm...

MAL-2025-120825 Malicious code in intermediate_rat_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46753183cc17b505b57a1eea5e3cfbef4265da9b1a29c3065ca89e7477152e91 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-74518

Malicious code in intermediatecanidaeblue-28 npm...

EUVD-2025-78969

Malicious code in intermediatemarmotz3n npm...

EUVD-2025-81505

Malicious code in intermediatemuskox0xrequest npm...

EUVD-2025-63457

Malicious code in intermediateboobyz3n npm...

EUVD-2025-63453

Malicious code in intermediatescallopz3n npm...

EUVD-2025-63455

Malicious code in intermediatenarwhalz3n npm...

MAL-2025-95102 Malicious code in intermediate_urial_requirement (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 919348391802e074872d77651d028574147fcba7a35b7e96ef4c42c8888017fa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...