An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.

...

Adversarial Bug Reports As a Security Risk in Language Model-Based Automated Program Repair

Large Language Model LLM - based Automated Program Repair APR systems are increasingly integrated into modern software development workflows, offering automated patches in response to natural language bug reports. However, this reliance on untrusted user input introduces a novel and underexplored...

Three Critical Facts About Cyber Risk Management

For CISOs responsible for cyber risk management, these three insights will help build a strong and reliable foundation for your proactive security strategy...

GHSA-WGQ8-VR6R-MQXM frost-core: refresh shares with smaller min_signers will reduce security of group

Impact It was not clear that it is not possible to change minsigners i.e. the threshold with the refresh share functionality frostcore::keys::refresh module. Using a smaller value would not decrease the threshold, and attempts to sign using a smaller threshold would fail. Additionally, after...

frost-core: refresh shares with smaller min_signers will reduce security of group

Impact It was not clear that it is not possible to change minsigners i.e. the threshold with the refresh share functionality frostcore::keys::refresh module. Using a smaller value would not decrease the threshold, and attempts to sign using a smaller threshold would fail. Additionally, after...

PT-2025-35722

Name of the Vulnerable Software and Affected Versions: mautic affected versions not specified Description: A user with administrator rights can modify the application’s configuration and extract sensitive information that is normally inaccessible. This allows an administrator to disclose...

Huawei EulerOS: Security Advisory for libcap (EulerOS-SA-2025-1911)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ALSA-2025:15123 Moderate: httpd:2.4 security update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: insufficient escaping of user-supplied data in modssl CVE-2024-47252 httpd: modssl: access control bypass by trusted clients is possible using TLS 1.3 session resumption...

Malicious code in demeter-protocol (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

CVE-2025-3586

In Liferay Portal 7.4.3.27 through 7.4.3.42, and Liferay DXP 2024.Q1.1 through 2024.Q1.20, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 27 through update 42 Liferay PaaS, and Liferay Self-Hosted, the Objects module does not restrict the use of Groovy scripts in Object...

Denial Of Service (DoS)

@oakserver/oak is vulnerable to Denial of Service DoS. The vulnerability is due to improper handling of specially crafted x-forwarded-proto or x-forwarded-for headers, which allows an attacker to significantly slow down an oak server...

Malicious code in monolith-twirp-git_src_migrator-migrations (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 549f13f989fce7c29dae7c0e9f28fe0add0808204154896a48c7d5b093e0d6aa The OpenSSF Package Analysis project identified 'monolith-twirp-gitsrcmigrator-migrations' @ 1.11.0 rubygems as malicious. It is considered...

Vulnerability of the cc_cipher_exit() function in the drivers/crypto/ccree/cc_cipher.c module – The driver for the Linux kernel’s cryptographic accelerator, which allows an attacker to compromise the confidentiality, integrity, and accessibility of protected information.

Vulnerability of the cccipherexit function in the drivers/crypto/ccree/cccipher.c module – Linux’s cryptographic acceleration driver is vulnerable due to the repeated use of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity...

Malicious code in @callcenter-frontend/ui-components (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f7f41480a8be02c290f1d1b9915b4a57528a979a2736206adf8e3c701b44f846 The OpenSSF Package Analysis project identified...

Malicious code in rtk-logger (npm)

The package rtk-logger was found to contain malicious code...

Malicious code in vite-ts-icon (npm)

The package vite-ts-icon was found to contain malicious code...

Malicious code in bingo-log (npm)

The package bingo-log was found to contain malicious code...

Malicious code in foundri (npm)

The package foundri was found to contain malicious code...

CVE-2025-30278 Qsync Central

An improper certificate validation vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Qsync Central...

QNAP QTS和QNAP QuTS hero 路径遍历漏洞

QNAP QTS is a NAS operating system developed by QNAPSystems, Inc. designed for network attached storage devices, providing data management, backup, multimedia entertainment, etc. QNAP QuTS hero is an enterprise-grade operating system developed by QNAP for its networked storage devices NAS, which ...