Trojans disguised as AI: Cybercriminals exploit DeepSeek’s popularity

Introduction Among the most significant events in the AI world in early 2025 was the release of DeepSeek-R1 – a powerful reasoning large language model LLM with open weights. It's available both for local use and as a free service. Since DeepSeek was the first service to offer access to a reasoni...

Linux Distros Unpatched Vulnerability : CVE-2025-23083

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - With the aid of the diagnosticschannel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also...

CLSA-2025-1741216285 Fix CVE(s): CVE-2024-47175

SECURITY UPDATE: PPD injection issues - debian/patches/CVE-2024-47175.patch: sanitize make and model, PPDize preset and template names in cups/ppd-cache.c - CVE-2024-47175...

CLSA-2025-1741215440 Fix CVE(s): CVE-2024-47175

SECURITY UPDATE: PPD injection issues - debian/patches/CVE-2024-47175.patch: validate URIs, attribute names, capabilities, and sanitize make and model in cups/ppd-cache.c, scheduler/ipp.c - CVE-2024-47175...

CVE-2024-43060

Memory corruption during voice activation, when sound model parameters are loaded from HLOS to ADSP...

CVE-2024-43061

Memory corruption during voice activation, when sound model parameters are loaded from HLOS, and the received sound model list is empty in HLOS drive...

Linux Distros Unpatched Vulnerability : CVE-2022-1651

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A memory leak flaw was found in the Linux kernel in acrndevioctl in the drivers/virt/acrn/hsm.c function in how the ACRN Device Model emulates virtual NICs in V...

The vulnerability of the Model Loading API component in NVIDIA Triton Inference Server (previously known as TensorRT Inference Server) allows a malicious actor to trigger a service failure.

The vulnerability of the Model Loading component of NVIDIA Triton Inference Server previously known as TensorRT Inference Server is related to a numerical overflow issue. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the set_qos() function in the internet.cgi script of the Wavlink AC3000 router microprogramming system allows a hacker to execute arbitrary commands.

The vulnerability of the setqos function in the internet.cgi script of the Wavlink AC3000 WL-WN533A8 router microprogramming system is related to the escape of operations from the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands by sending...

Linux Distros Unpatched Vulnerability : CVE-2024-21890

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. For example:...

Apollo 访问控制错误漏洞

Apollo is a genome annotation editor in the Generic Model Organism Database open source. An access control error vulnerability exists in Apollo versions prior to 2.8.0 that stems from a lack of authentication and allows bypassing privilege checks...

Linux Distros Unpatched Vulnerability : CVE-2022-49194

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: bcmgenet: Use stronger register read/writes to assure ordering GCC12 appears to be much smarter about its dependency tracking and is aware that the relaxed...

CVE-2019-1815 Cisco Meraki MX67 and MX68 Sensitive Information Disclosure Vulnerability

A security vulnerability was discovered in the local status page functionality of Cisco Meraki’s MX67 and MX68 security appliance models that may allow unauthenticated individuals to access and download logs containing sensitive, privileged device information. The vulnerability is due to improper...

Flowise 代码问题漏洞

Flowise is a FlowiseAI open source tool for easily building LLM applications. A security vulnerability exists in Flowise version 2.2.6 that stems from the presence of an arbitrary file upload issue...

The vulnerability of TP-Link TL-WR840N router’s microprogramming software, related to deficiencies in authentication procedures, allows attackers to circumvent existing security restrictions.

The vulnerability of TP-Link TL-WR840N router’s microprogramming software is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions by sending a specially crafted request with the Referer header set...

Linux Distros Unpatched Vulnerability : CVE-2015-2752

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The XENDOMCTLmemorymapping hypercall in Xen 3.2.x through 4.5.x, when using a PCI passthrough device, is not preemptible, which allows local x86 HVM domain user...

DZS ZNID-GPON-2428B1-0ST 跨站脚本漏洞

The DZS ZNID-GPON-2428B1-0ST is a router from DZS. A cross-site scripting vulnerability exists in the DZS ZNID-GPON-2428B1-0ST, which stems from susceptibility to cross-site scripting attacks that allow injection of malicious code...

Linux Distros Unpatched Vulnerability : CVE-2021-26291

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Maven will follow repositories that are defined in a dependency's Project Object Model pom which may be surprising to some users, resulting in potential...

GHSA-769V-P64C-89PR PyTorch Model Files Can Bypass Pickle Scanners via Unexpected Pickle Extensions

CVE-2025-1889 Summary Picklescan fails to detect hidden pickle files embedded in PyTorch model archives due to its reliance on file extensions for detection. This allows an attacker to embed a secondary, malicious pickle file with a non-standard extension inside a model archive, which remains...

PyTorch Model Files Can Bypass Pickle Scanners via Unexpected Pickle Extensions

CVE-2025-1889 Summary Picklescan fails to detect hidden pickle files embedded in PyTorch model archives due to its reliance on file extensions for detection. This allows an attacker to embed a secondary, malicious pickle file with a non-standard extension inside a model archive, which remains...