A Retrospective Survey of 2024/2025 Open Source Supply Chain Compromises

Lack of memory safety is such a predominant cause of security issues that we have a responsibility as professional software engineering to robustly mitigate it in security-sensitive use cases—by using memory safe languages. Similarly, I have the growing impression that software supply chain...

Autonomous AI Hacking and the Future of Cybersecurity

AI agents are now hacking computers. They're getting better at all phases of cyberattacks, faster than most of us expected. They can chain together different aspects of a cyber operation, and hack autonomously, at computer speeds and scale. This is going to change everything. Over the summer,...

Cross-site Scripting (XSS)

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Cross-site Scripting XSS via improper input neutralization in the web page generation in Vega visualizations. An attacker can...

[SECURITY] Fedora 42 Update: pgadmin4-9.8-2.fc42

pgAdmin is the most popular and feature rich Open Source administration and d evelopment platform for PostgreSQL, the most advanced Open Source database in the world...

Perfex CRM 安全漏洞

Perfex CRM is a customer relationship management software from Perfex CRM open source. It is used to manage customers, projects and create invoices in the cloud. A security vulnerability exists in Perfex CRM version 3.3.1 that stems from uncleaned user input and could lead to an HTML injection...

JLSEC-2025-9 ImageMagick is free and open-source software used for editing and manipulating digital images

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0, infinite lines occur when writing during a specific XMP file conversion command. Version 7.1.2-0 fixes the issue...

Information Exposure

Overview bbot is an OSINT automation for hackers. Affected versions of this package are vulnerable to Information Exposure via the gitlab process. An attacker can obtain sensitive API key information by tricking the system into connecting to a maliciously crafted git URL. Remediation Upgrade bbot...

CVE-2025-62228

creationtimestamp| type| source ---|---|--- 2025-10-09 13:48:50+00:00| seen| https://seclists.org/oss-sec/2025/q4/20...

[SECURITY] Fedora 41 Update: chromium-141.0.7390.54-1.fc41

Chromium is an open-source web browser, powered by WebKit Blink...

i-Educar 安全漏洞

i-Educar is a free educational software from Portábilis Open Source. A security vulnerability exists in i-Educar version 2.9.10 and earlier, which stems from improper privilege inheritance in the user type handling component in the file app/Http/Controllers/AccessLevelController.php, which could...

Allstar 信任管理问题漏洞

Allstar is an Open Source Security Foundation open source security policy software. A trust management issue vulnerability exists in Allstar versions prior to 4.5, which stems from the Reviewbot component using a hard-coded shared key to validate an inbound webhook request, which could lead to a...

BBOT 安全漏洞

BBOT is an open source recursive internet scanner from Black Lantern Security. BBOT has a security vulnerability that stems from a malicious git repository that could lead to command execution...

New API 代码问题漏洞

New API is a QuantumNous open source interface software. A code issue vulnerability exists in New API versions prior to 0.9.0.5 that stems from not properly validating a user-supplied URL, which could lead to a server-side request forgery attack...

xckk 安全漏洞

xckk small dishes low-code development platform is a low-code development platform open source by China Cloud Network Software bestfeng. A security vulnerability exists in xckk v9.6, which stems from the orderBy parameter in user/list is not securely filtered, which may lead to SQL injection...

JLSEC-2025-6 An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack...

An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS before version 0.3.18. Specially crafted inputs passed to these functions could cause an application using lapack to crash or possibly disclose...

Chinese Hackers Weaponize Open-Source Nezha Tool in New Attack Wave

Threat actors with suspected ties to China have turned a legitimate open-source monitoring tool called Nezha into an attack weapon, using it to deliver a known malware called Gh0st RAT to targets. The activity, observed by cybersecurity company Huntress in August 2025, is characterized by the use...

Security Bulletin: Multiple vulnerabilities that affects IBM Db2 Data Management Console( CVE-2022-1471,CVE-2024-22259,CVE-2020-8565, CVE-2019-11250,CVE-2023-44487,CVE-2022-46175, CVE-2024-22243)

Summary SnakeYaml Constructor Deserialization Remote Code Execution. Spring-web-6.0.11, k8s.io-client-go, k8s.io-Apimachinery-v0.25.1, json5-1.0.1, spring-web-6.0.11 open source libraries are used by IBM Db2 Data Management Console . This bulletin describes the upgrades necessary to address the...

Malicious code in v0-next-shadcn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ca5e9e552239df0cdd60e60db1ee3aa37558a7ae490767639b25d3932079c8e3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Casdoor 安全漏洞

Casdoor is an open source platform from Casdoor Open Source that supports multiple authentication and authorization protocols. A security vulnerability exists in Casdoor versions prior to 2.26.0, which stems from a flaw in the permission validation module and editing interface that could lead to ...

Pixel Update Bulletin—October 2025Stay organized with collectionsSave and categorize content based on your preferences.

The Pixel Update Bulletin contains details of security vulnerabilities and functional improvements affecting supported Pixel devices Google devices. For Google devices, security patch levels of 2025-10-01 or later address all issues in this bulletin and all issues in the October 2025 Android...