CVE-2025-62781

PILOS (Frontend for BigBlueButton) prior to version 4.8.0 exposes a session-regen flaw: when a local user changes their password, all other active sessions are terminated except the current one, whose token is not refreshed. If an attacker already possesses that session token (from another vulner...

Malicious code in sreadmin-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b2b51756599b7bbc43536b940ffec7c6c41643e17ababeb1e976c191e166a0b The package sreadmin-base was found to contain malicious code. Source: ghsa-malware 14efd7a15525321ad3633779f0074512b8ca809312a5093e4d1be2e33a5219bb...

CVE-2025-34503

Deck Mate 1 executes firmware directly from an external EEPROM without verifying authenticity or integrity. An attacker with physical access can replace or reflash the EEPROM to run arbitrary code that persists across reboots. Because this design predates modern secure-boot or signed-update...

Malicious code in web-vitals-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a1207a63be39e0d3a2b8f5721ba241bde1b85c1246c5de3ec904e8eacab4e90 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

curl: curl’s persistence files inherit world-readable/writable perms from umask, leaking and tampering with cookies/HSTS/Alt-Svc caches

Executive Summary Curlfopen clones the permissions of any pre-existing persistence file when creating its temporary file. When the persistence file does not exist, it first creates one with the process umask typically 022, i.e., 0644. That mode is then copied to the temp file via 0600 | sb.stmode...

Active Water Saci Campaign Spreading Via WhatsApp Features Multi-Vector Persistence and Sophisticated C&C

Continuous investigation on the Water Saci campaign reveals innovative email-based C&C system, multi-vector persistence, and real-time command capabilities that allow attackers to orchestrate coordinated botnet operations, gather detailed campaign intelligence, and dynamically control malware...

PT-2025-44055

Name of the Vulnerable Software and Affected Versions PILOS versions prior to 4.8.0 Description PILOS, a frontend for BigBlueButton, contains a flaw where changing a local user’s password does not invalidate existing session tokens, except for the current session. An attacker who previously...

Siemens SIMATIC Devices Improper Input Validation (CVE-2025-21756)

vsock: Keep the binding until socket destruction Preserve sockets bindings; this includes both resulting from an explicit bind and those implicitly bound through autobind during connect. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

[SECURITY] Fedora 43 Update: valkey-8.1.4-2.fc43

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing s...

CVE-2025-62723

FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.23.2, any authenticated user can create sessions and have them collect QoS messages. When not sent to a client, these are then not released upon eventual session expiration. Version 1.23.2 fixes the issue...

EUVD-2025-35894

Deck Mate 2 lacks a verified secure-boot chain and runtime integrity validation for its controller and display modules. Without cryptographic boot verification, an attacker with physical access can modify or replace the bootloader, kernel, or filesystem and gain persistent code execution on reboo...

EUVD-2025-35893

Deck Mate 1 executes firmware directly from an external EEPROM without verifying authenticity or integrity. An attacker with physical access can replace or reflash the EEPROM to run arbitrary code that persists across reboots. Because this design predates modern secure-boot or signed-update...

CVE-2025-34503 Shuffle Master Deck Mate 1 Unauthenticated EEPROM Firmware Execution

Deck Mate 1 executes firmware directly from an external EEPROM without verifying authenticity or integrity. An attacker with physical access can replace or reflash the EEPROM to run arbitrary code that persists across reboots. Because this design predates modern secure-boot or signed-update...

CVE-2025-34502

The CVE-2025-34502 entry affects Deck Mate 2 by lacking a verified secure-boot chain and runtime integrity validation for its controller and display modules. This allows a physically proximate attacker to modify or replace the bootloader, kernel, or filesystem, enabling persistent code execution ...

Persistence Exploit Suggester

This module suggests persistence modules that can be used. The modules are suggested based on the architecture and platform that the user has a shell opened as well as the available exploits in meterpreter. It's important to note that not all modules will be checked. Exploits are chosen based on...

Metasploit Wrap-Up 10/24/2025

Let us suggest persistence… This week's edition brings the new persistence suggester from h00die. Similar to the exploit variant, this module will list the available persistence mechanisms for your selected target. The module requires a session to target the machine, so it can run check methods...

MAL-2025-48593 Malicious code in gamenodev2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64b3f4352a6a3cd544967811466ca6b70f6171d40b606d11f2b3375921c68d6b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gamenodev21 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eed42bff5f057d49a644923b46ba868c04890e51c77dffc911c3aaa0be4e0640 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48579 Malicious code in mtls-ambassador (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7751747bc3d849e8a9b44fe993f8e2e3a5779f8c940573453433084eb4d3a07b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48567 Malicious code in mender-artifact (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e94134964d7a293444da55c5300ca285bae3eac4e6bf9a1f89cc1d9a94f2ceae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...