3926 matches found
CVE-2025-59331 [email protected] contains malware after npm account takeover
is-arrayish checks if an object can be used like an Array. On 8 September 2025, an npm publishing account for is-arrayish was taken over after a phishing attack. Version 0.3.3 was published, functionally identical to the previous patch version, but with a malware payload added attempting to...
Fedora: Security Advisory (FEDORA-2025-bdd1059817)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Malicious code in @js-to-lua/handler-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ecbb26f98b0d1520a3801861e0c434568d5ac1958606124e217a6e10eda3c436 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Security Bulletin: SSL Certificate Hostname Verification Bypass in Apache Commons HttpClient 3.x Allowing MITM Attacks affects watsonx.data
Summary Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service FPS merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows...
CVE-2025-50096 affecting package mysql for versions less than 8.0.43-1
CVE-2025-50096 affecting package mysql for versions less than 8.0.43-1. An upgraded version of the package is available that resolves this issue...
OESA-2025-2162 binutils security update
Binutils is a collection of binary utilities, including ar for creating, modifying and extracting from archives, as a family of GNU assemblers, gprof for displaying call graph profile data, ld the GNU linker, nm for listing symbols from object files, objcopy for copying and translating object...
MINI-PHHJ-P86Q-X66G
Bulletin has no description...
MINI-F6XC-V9MV-QGMW
Bulletin has no description...
CVE-2024-40664
In setupAccessibilityServices of AccessibilityFragment.java , there is a possible way to hide an enabled accessibility service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitati...
CVE-2025-48551
In multiple locations, there is a possible leak of an image across the Android User isolation boundary due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation...
CVE-2025-0076
In multiple locations, there is a possible way to view icons belonging to another user due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2025-26441
In addattr of sdpdiscovery.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
From summer camp to grind season
Welcome to this week's edition of the Threat Source newsletter. This is the way the world ends This is the way the world ends This is the way the world ends Not with a bang but a whimper. - T.S. Eliot So this is how Summer Camp 2025 ends, not with a bang but a whimper. We've put the summer behind...
GHSA-9HP6-4448-45G2
creationtimestamp| type| source ---|---|--- 2025-09-04 15:35:19+00:00| seen| https://bsky.app/profile/azu.bsky.social/post/3lxzhvz4hvv2d...
CVE-2025-38717
In the Linux kernel, the following vulnerability has been resolved: net: kcm: Fix race condition in kcmunattach syzbot found a race condition when kcmunattachpsock and kcmreleasekcm are executed at the same time. kcmunattach is missing a check of the flag kcm-txstopped before calling queuework. I...
GHSA-3P8M-J85Q-PGMJ vulnerabilities
Vulnerabilities for packages: logstash-input-tcp, tez, spark, solr, sonarqube, cloudwatch-exporter, akhq, cassandra-reaper, apache-pulsar, logstash-input-beats, celeborn, docker-selenium, kserve-modelmesh, infinispan, apicurio-registry, zookeeper, apache-nifi, wavefront-proxy, keycloak, zipkin,...
CVE-2025-41033
creationtimestamp| type| source ---|---|--- 2025-09-04 13:15:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lxza3abjzu2n...
Moderate: Red Hat Security Advisory: qt5-qt3d security update
An update for qt5-qt3d is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
Reflecting on Wallarm’s Journey: Growth, Resilience, and What Comes Next
By Ivan Novikov and Stepan Ilyin When we started Wallarm, we focused on the APIs that power modern apps. We built an API-first platform, used AI from day one, and secured early patents in behavior-based detection and automated policy creation. The result: real-time, inline blocking with automatic...
