MAL-2025-3865 Malicious code in mfe-react-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f7835d0f6b232544302030371ac74d4c595860a04736a2ef54259a32993f9c8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SynFuzz: Leveraging Fuzzing of Netlist to Detect Synthesis Bugs

In the evolving landscape of integrated circuit IC design, the increasing complexity of modern processors and intellectual property IP cores has introduced new challenges in ensuring design correctness and security. The recent advancements in hardware fuzzing techniques have shown their efficacy ...

CVE-2025-47784

Emlog (open-source website building system) is affected by CVE-2025-47784 in versions 2.5.13 and earlier, due to a deserialization vulnerability. A crafted nickname can trigger str_replace to set name_orig to an empty value, causing deserialization to fail and return false. The issue is mitigated...

CVE-2025-47784 Emlog vulnerable to Deserialization of Untrusted Data

Emlog is an open source website building system. Versions 2.5.13 and prior have a deserialization vulnerability. A user who creates a carefully crafted nickname can cause strreplace to replace the value of nameorig with empty, causing deserialization to fail and return false. Commit...

Checkmate 安全漏洞

Checkmate is an open source, self-hosted tool from BlueWave Open Source designed to track and monitor server hardware, uptime, response time and events in real-time with beautiful visualizations. A security vulnerability exists in Checkmate versions prior to 2.1 that stems from unrestricted acces...

pGina 安全漏洞

pGina is an open source Windows authentication tool from the individual developer Hans Wurst. A security vulnerability exists in pGina version 3.9.9.12 and earlier, which stems from the HttpAuth plugin that can bypass authentication when DNS resolution is controlled...

Bootstrap 安全漏洞

Bootstrap is an open source web front-end framework developed using HTML, CSS and JavaScript by Bootstrap Inc. A security vulnerability exists in Bootstrap versions prior to 3.4.1 through 4.0.0 that stems from improper input neutralization and could lead to a cross-site scripting attack...

Modular Account 安全漏洞

Modular Account is an open source application from Alchemy. A security vulnerability exists in Modular Account that stems from the allowlist module not checking the executeUserOp path, which could lead to bypassing access control restrictions...

itsourcecode Placement Management System 注入漏洞

itsourcecode Placement Management System is an open source placement management system by itsourcecode. An injection vulnerability exists in version 1.0 of itsourcecode Placement Management System, which originates from a SQL injection due to incorrect manipulation of the parameter ID in the file...

DumbDrop 跨站脚本漏洞

DumbDrop is a DumbWare open source application. A cross-site scripting vulnerability exists in versions prior to DumbDrop db27b25, which stems from a DOM cross-site scripting vulnerability in the upload function...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a privilege issue vulnerability that stems from insufficient privilege validation, which can be exploited by an attacker to view group information via an API request...

Analysing Safety Risks in LLMs Fine-Tuned with Pseudo-Malicious Cyber Security Data

The integration of large language models LLMs into cyber security applications presents significant opportunities, such as enhancing threat analysis and malware detection, but can also introduce critical risks and safety concerns, including personal data leakage and automated generation of new...

CVE-2025-47781 Rallly Insufficient Password Login Token Entropy Leads to Account Takeover

Rallly is an open-source scheduling and collaboration tool. Versions up to and including 3.22.1 of the application features token based authentication. When a user attempts to login to the application, they insert their email and a 6 digit code is sent to their email address to complete the...

Malicious code in webpack-cli-v4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6923a0b0ac00b6df0f50acbb796a23891fbe7d857f5f130a62b03f3a7cea9da8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

[SECURITY] Fedora 41 Update: chromium-136.0.7103.92-1.fc41

Chromium is an open-source web browser, powered by WebKit Blink...

Unspecified Vulnerability in RT-Labs P-Net (CNVD-2025-10049)

RT-Labs P-Net is an open source PROFINET protocol stack from RT-Labs that enables standard communication between industrial devices and PROFINET controllers. A security vulnerability exists in RT-Labs P-Net version 1.0.1 and earlier, which stems from a null pointer dereference, and can be exploit...

Adversarial Attack on Large Language Models Using Exponentiated Gradient Descent

As Large Language Models LLMs are widely used, understanding them systematically is key to improving their safety and realizing their full potential. Although many models are aligned using techniques such as reinforcement learning from human feedback RLHF, they are still vulnerable to jailbreakin...

Unspecified Vulnerability in RT-Labs P-Net

RT-Labs P-Net is an open source PROFINET protocol stack from RT-Labs that enables standard communication between industrial devices and PROFINET controllers. A security vulnerability exists in RT-Labs P-Net version 1.0.1 and prior versions, which stems from an unchecked loop condition that can be...

Unspecified Vulnerability in RT-Labs P-Net (CNVD-2025-10050)

RT-Labs P-Net is an open source PROFINET protocol stack from RT-Labs that enables standard communication between industrial devices and PROFINET controllers. A security vulnerability exists in RT-Labs P-Net version 1.0.1 and prior versions, which can be exploited by an attacker to cause an IO...

The vulnerability of software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce B2B lies in the insufficient protection of registration data. This allows attackers to gain unauthorized access to protected information.

The vulnerabilities of software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce B2B are related to insufficient protection of registration data. Exploiting these vulnerabilities can allow a malicious actor, operating remotely, to...