Leveraging Credentials As Unique Identifiers: A Pragmatic Approach To NHI Inventories 

Identity-based attacks are on the rise. Attacks in which malicious actors assume the identity of an entity to easily gain access to resources and sensitive data have been increasing in number and frequency over the last few years. Some recent reports estimate that 83% of attacks involve compromis...

CGA-W975-C4F8-45Q3

Bulletin has no description...

CGA-GFQW-6J74-CWFX

Bulletin has no description...

PT-2025-27208 · Hidepost · Hidepost

Name of the Vulnerable Software and Affected Versions: HidePost versions prior to 2.3.8 Description: A Cross-Site Request Forgery CSRF issue in HidePost allows for Reflected XSS. This means an attacker could potentially trick a user into performing unintended actions on the web application...

CERTFR-2025-ACT-026

creationtimestamp| type| source ---|---|--- 2025-06-23 12:20:29+00:00| seen| https://bsky.app/profile/cert-fr.bsky.social/post/3lsbkyfpb4524 2025-06-23 12:20:33+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/114732644952742769...

Google Adds Multi-Layered Defenses to Secure GenAI from Prompt Injection Attacks

Google has revealed the various safety measures that are being incorporated into its generative artificial intelligence AI systems to mitigate emerging attack vectors like indirect prompt injections and improve the overall security posture for agentic AI systems. "Unlike direct prompt injections,...

MAL-2025-5192 Malicious code in @com.att.vstb/vstb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 554029aed2bd3e734c058d64b6b283e3534367b5d8cf1d6162845499091f8ea5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5193 Malicious code in envs-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14d66a16720127b714fd0b4972d056bd66309e46b1cbf745656b742fe3bc33f3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-26320 · Coros · Coros

Name of the Vulnerable Software and Affected Versions: COROS application versions 3.8.12 and earlier Description: The issue concerns the COROS application's handling of Bluetooth pairing and bonding. The application does not initiate or enforce pairing and bonding, and the watch also does not...

MAL-2025-5261 Malicious code in drivers-kit (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0ba30922790421a31176c5d094f9244d7e2c5aefa5a38c9506763c5adb863f66 Any computer that has this package installed or running should be considered...

Adobe Commerce Access Control Error Vulnerability

Adobe Commerce is the United States of America Odobie Adobe company's a business and brand-oriented global leader in digital commerce solutions. An Access Control Error vulnerability exists in Adobe Commerce that stems from improper access control and can be exploited by an attacker to bypass...

CGA-QC9F-Q6WJ-F4PQ

Bulletin has no description...

PT-2025-25359 · Palo Alto Networks · Palo Alto Networks Prisma Access Browser

Name of the Vulnerable Software and Affected Versions: Palo Alto Networks Prisma Access Browser affected versions not specified Description: The issue is related to an insufficient implementation of cache vulnerability in the browser, which allows users to bypass certain data control policies. Th...

PT-2025-25183 · Unknown · Perfect Harmony Gh180

Name of the Vulnerable Software and Affected Versions: Perfect Harmony GH180 versions V8.0 through V8.3.3 Description: A security issue has been identified where the maintenance connection of affected devices does not protect access to the device's control unit configuration. This could allow an...

CVE-2025-46889

Adobe Experience Manager (AEM)

CVE-2025-36852

A critical security vulnerability exists in remote cache extensions for common build systems utilizing bucket-based remote cache such as those using Amazon S3, Google Cloud Storage, or similar object storage that allows any contributor with pull request privileges to inject compromised artifacts...

CVE-2025-36852 Build Cache Poisoning via Untrusted Pull Requests

A critical security vulnerability exists in remote cache extensions for common build systems utilizing bucket-based remote cache such as those using Amazon S3, Google Cloud Storage, or similar object storage that allows any contributor with pull request privileges to inject compromised artifacts...

CVE-2025-36852 Build Cache Poisoning via Untrusted Pull Requests

A critical security vulnerability exists in remote cache extensions for common build systems utilizing bucket-based remote cache such as those using Amazon S3, Google Cloud Storage, or similar object storage that allows any contributor with pull request privileges to inject compromised artifacts...

MicroDicom DICOM Viewer

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on affected installations of DICOM Viewer. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:...

MAL-2025-4808 Malicious code in @loybung/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9e4ad6dc27f068d9c2140a021ffc400d65281d8cb3bc6f19890e071c25e51492 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...