[SECURITY] Fedora 43 Update: firefox-147.0-1.fc43

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

InputPlumber 访问控制错误漏洞

InputPlumber is an input device routing daemon in the ShadowBlip open source. An access control error vulnerability exists in InputPlumber that stems from the presence of a race condition in authorization checking...

pH7 Social Dating Builder 17.9.1 安全漏洞

pH7 Social Dating Builder is an open source social dating system from pH7 Social Dating CMS. A security vulnerability exists in pH7 Social Dating Builder version 17.9.1, which stems from stored cross-site scripting in the user profile description field...

Blue Teaming Function-Calling Agents

We present an experimental evaluation that assesses the robustness of four open source LLMs claiming function-calling capabilities against three different attacks, and we measure the effectiveness of eight different defences. Our results show how these models are not safe by default, and how the...

InputPlumber 安全漏洞

InputPlumber is an open source input device routing daemon from ShadowBlip. A security vulnerability exists in InputPlumber versions prior to v0.63.0, which stems from a lack of authorization and could lead to a local denial of service, information disclosure, or elevation of privilege...

Typesetter CMS 跨站脚本漏洞

Typesetter CMS is a content management system from Typesetter open source. A cross-site scripting vulnerability exists in Typesetter CMS 5.1 and earlier versions, which stems from insufficient cleanup and escaping of the images parameter and could lead to a reflective cross-site scripting attack...

EUVD-2025-206285

Open Source Point of Sale opensourcepos is a web based point of sale application written in PHP using CodeIgniter framework. opensourcepos 3.4.0 and 3.4.1 has a stored XSS vulnerability exists in the Configuration Information functionality. An authenticated user with the permission “Configuration...

CVE-2025-68658

CVE-2025-68658 affects Open Source Point of Sale (opensourcepos) 3.4.0–3.4.1. It is a stored XSS in the Configuration → Information workflow: an authenticated user with the permission “Configuration: Change OSPOS's Configuration” can inject JavaScript into the Company Name field; the payload is s...

CVE-2025-68658 Open Source Point of Sale (opensourcepos) Stored XSS in Configuration (Information) – Company Name field

Open Source Point of Sale opensourcepos is a web based point of sale application written in PHP using CodeIgniter framework. opensourcepos 3.4.0 and 3.4.1 has a stored XSS vulnerability exists in the Configuration Information functionality. An authenticated user with the permission “Configuration...

MAL-2026-249 Malicious code in @flipster/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7959db4a5848d904daa027ec759ca4588e6c033f1df17a82686a3d28d2dd2e9f The package @flipster/utils was found to contain malicious code. Source: ghsa-malware 0490c6f411da9b1fa5efbfd1cad8e7b41ec915751813279fb2a89a0f5e96752...

Zeek 8.0.5

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know. While focusing on network security monitoring, Zeek provides a comprehensive platform for more general network traffic analysis as well. Well grounded in more than 15 years of research, Zeek ha...

Open Source Point of Sale 跨站脚本漏洞

Open Source Point of Sale is an open source web-based point of sale system from opensourcepos. A cross-site scripting vulnerability exists in Open Source Point of Sale versions 3.4.0 and 3.4.1, which stems from a stored cross-site script in the configuration function that could cause an...

PT-2026-2806

Name of the Vulnerable Software and Affected Versions Cal.com versions 3.1.6 through 6.0.6 Description Cal.com, an open-source scheduling software, has a critical flaw in a custom NextAuth JWT callback. This issue allows attackers to gain full authenticated access to any user's account by supplyi...

编号撤回

Wing FTP Server is the Wing FTP Server open source suite of cross-platform FTP server software. This CVE number has been withdrawn...

Eigent 代码注入漏洞

Eigent is a multi-agent workflow desktop application open-sourced by Eigent AI. Eigent suffers from a code injection vulnerability that stems from a CI workflow using the pullrequesttarget trigger and checking out untrusted PR code, which could lead to arbitrary code execution...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a failure to check the POSIX ACL attribute when creating a file, resulting in a failure to set the ACL...

[SECURITY] Fedora 42 Update: chromium-143.0.7499.192-1.fc42

Chromium is an open-source web browser, powered by WebKit Blink...

When Bots Take the Bait: Exposing and Mitigating the Emerging Social Engineering Attack in Web Automation Agent

Web agents, powered by large language models LLMs, are increasingly deployed to automate complex web interactions. The rise of open-source frameworks e.g., Browser Use, Skyvern-AI has accelerated adoption, but also broadened the attack surface. While prior research has focused on model threats su...

Operational Runtime Behavior Mining for Open-Source Supply Chain Security

Open-source software OSS is a critical component of modern software systems, yet supply chain security remains challenging in practice due to unavailable or obfuscated source code. Consequently, security teams often rely on runtime observations collected from sandboxed executions to investigate...

CVE-2026-22691

pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for malformed startxref. An attacker who uses this vulnerability can craft a PDF which leads to possibly long runtimes for invalid startxref entries. When rebuilding the cross-referen...