New 'Rules File Backdoor' Attack Lets Hackers Inject Malicious Code via AI Code Editors

Cybersecurity researchers have disclosed details of a new supply chain attack vector dubbed Rules File Backdoor that affects artificial intelligence AI-powered code editors like GitHub Copilot and Cursor, causing them to inject malicious code. "This technique enables hackers to silently compromis...

CVE-2023-22512

CVE-2023-22512 is a DoS vulnerability in Atlassian Confluence Data Center and Server. Introduced in version 5.6, it allows an unauthenticated, network-based attacker to make a Confluence instance unavailable, with no impact to confidentiality or integrity and a high availability impact (CVSS v3.1...

CVE-2025-25616

Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows students to modify rules for exams. The affected endpoint is /exams/edit-rule?examruleid=1...

GO-2025-3508 LF Edge eKuiper allows Stored XSS in Rules Functionality in github.com/lf-edge/ekuiper

LF Edge eKuiper allows Stored XSS in Rules Functionality in github.com/lf-edge/ekuiper...

Important: Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.5.0 release

Red Hat build of OpenTelemetry 3.5.0 has been released Release of Red Hat OpenShift distributed tracing provides following security improvements, bug fixes, and new features. Breaking changes: Nothing Deprecations: In the Red Hat build of OpenTelemetry 3.5, the Loki Exporter, which is a temporary...

Cloudflare Public Bug Bounty: Bypass of Cloudflare's Cache Keys and WAF via header overflow

A limitation in the HTTP request header parsing in Front Line FL processing enabled attackers to bypass defined rulesets. The maximum amount of headers being parsed by openresty was 100 HTTP headers including internal ones. This problem applied to any ruleset on HTTP headers. Attackers were able ...

PT-2025-17553 · Totolink · Totolink A810R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A810R version 4.1.2cu.5182 B20201026 Description: A stack overflow issue was discovered via the startTime and endTime parameters in the setParentalRules function. Recommendations: For TOTOLINK A810R version 4.1.2cu.5182 B20201026, as...

Improper Neutralization

laravel/framework is vulnerable to Improper Neutralization. The vulnerability is due to improper validation enforcement due to the incorrect handling of wildcard validation files., allowing user-crafted malicious requests to bypass file or image validation rules...

CVE-2025-25616

Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows students to modify rules for exams. The affected endpoint is /exams/edit-rule?examruleid=1...

CVE-2025-25616

Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows students to modify rules for exams. The affected endpoint is /exams/edit-rule?examruleid=1...

Unifiedtransform 访问控制错误漏洞

Unifiedtransform is an open source school management software from the individual developer Hasib Mahmud. A security vulnerability exists in Unifiedtransform version 2.0 that stems from improper access control and could lead to students modifying exam rules...

CVE-2025-25616

CVE-2025-25616 : Unifiedtransform 2.0 is vulnerable to Incorrect Access Control that allows students to modify exam rules through the endpoint /exams/edit-rule?exam_rule_id=1 . Root cause: improper access control. Documented impact includes high confidentiality and integrity impact with an overal...

CVE-2025-26849

There is a Hard-coded Cryptographic Key in Docusnap 13.0.1440.24261, and earlier and later versions. This key can be used to decrypt inventory files that contain sensitive information such as firewall rules...

Linux Distros Unpatched Vulnerability : CVE-2024-8118

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write...

Linux Distros Unpatched Vulnerability : CVE-2024-50063

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Prevent tail call between progs attached to different hooks bpf progs can be attached to kernel functions, and the attached functions can take different...

Linux Distros Unpatched Vulnerability : CVE-2022-24736

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Redis is an in-memory database that persists on disk. Prior to versions 6.2.7 and 7.0.0, an attacker attempting to load a specially crafted Lua script can cause...

The vulnerability of the tool for configuring and managing Linux operating system’s iptables packet filtering rules stems from insecure privilege management, allowing a malicious actor to execute arbitrary bash commands.

The vulnerability of the tool for configuring and managing iptables packet filtering rules in Linux operating systems is related to insecure management of privileges. Exploiting this vulnerability allows a malicious actor to execute arbitrary bash commands by adding comments to security rules fro...

Linux Distros Unpatched Vulnerability : CVE-2023-28842

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream...

Linux Distros Unpatched Vulnerability : CVE-2022-0675

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In certain situations it is possible for an unmanaged rule to exist on the target system that has the same comment as the rule specified in the manifest. This...

Linux Distros Unpatched Vulnerability : CVE-2021-47103

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - inet: fully convert sk-skrxdst to RCU rules syzbot reported various issues around early demux, one being included in this changelog 1 sk-skrxdst is using RCU...