CVE-2025-48533

CVE-2025-48533 affects the Android Framework. A race condition in the lockscreen context menu can be exploited to perform local escalation of privilege by using apps linked from the context menu, without additional execution privileges or user interaction. The vulnerability is characterized as Eo...

Meta Platforms WhatsApp Incorrect Authorization Vulnerability

Meta Platforms WhatsApp contains an incorrect authorization vulnerability due to an incomplete authorization of linked device synchronization messages. This vulnerability could allow an unrelated user to trigger processing of content from an arbitrary URL on a target’s device...

MAL-2025-45765 Malicious code in react-native-wm-barcode (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d41cd8af4fc659204e641358eda189dac7d136a2918f8cec5c945431ced9a512 Any computer that has this package installed or running should be considered...

MAL-2025-44705 Malicious code in internal-helper-utils (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

CVE-2025-55177

Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We...

WhatsApp Patches Zero-Click Exploit Targeting iOS and macOS Devices

WhatsApp has addressed a security vulnerability in its messaging apps for Apple iOS and macOS that it said may have been exploited in the wild in conjunction with a recently disclosed Apple flaw in targeted zero-day attacks. The vulnerability, CVE-2025-55177 CVSS score: 5.4, relates to a case of...

MAL-2025-42028 Malicious code in mpesa-backoffice-ekyc-frontend (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a1d40690b03ef978ac9c358228d4e0372e07e448e4e8d894ab44d49e70d23bac Any computer that has this package installed or running should be considered...

CVE-2025-55177

Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We...

CVE-2025-55177

Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We...

CVE-2025-55177

Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We...

CVE-2025-55177

Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We...

CVE-2025-55177

CVE-2025-55177 affects WhatsApp products on iOS (prior to v2.25.21.73), WhatsApp Business for iOS (v2.25.21.78), and WhatsApp for Mac (v2.25.21.78). The root cause is incomplete authorization of linked device synchronization messages, which could allow an unrelated user to trigger processing of c...

Malicious code in example-multipass (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b8ecd17d835fed194bf6392aca9f2fe17844a455e585ae06161bb8a41ad9748d The OpenSSF Package Analysis project identified 'example-multipass' @ 10.0.1 npm as malicious. It is considered malicious because: - The package...

PT-2025-35227

Name of the Vulnerable Software and Affected Versions: WhatsApp versions prior to v2.25.21.73 for iOS, versions prior to v2.25.21.78 for WhatsApp Business for iOS, and versions prior to v2.25.21.78 for WhatsApp for Mac. Description: WhatsApp was found to have an incomplete authorization flaw in...

Facebook WhatsApp 安全漏洞

Facebook WhatsApp is a suite of mobile applications from Facebook Inc. in the United States that are based on the Android platform and utilize the network to deliver text messages. The application uses contact information in a smartphone to find contacts using the software to send texts, pictures...

MAL-2025-41967 Malicious code in design-system-components-angular-workspace (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-41932 Malicious code in @rbapp/store (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

Malicious code in @rbacore/enums (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

Malicious code in pglite-2 (npm)

The package communicates with a domain associated with malicious activity...

Salt Typhoon Exploits Flaws in Edge Network Devices to Breach 600 Organizations Worldwide

The China-linked advanced persistent threat APT actor known as Salt Typhoon has continued its attacks targeting networks across the world, including organizations in the telecommunications, government, transportation, lodging, and military infrastructure sectors. "While these actors focus on larg...