CVE-2022-50634 power: supply: cw2015: Fix potential null-ptr-deref in cw_bat_probe()

In the Linux kernel, the following vulnerability has been resolved: power: supply: cw2015: Fix potential null-ptr-deref in cwbatprobe cwbatprobe calls createsinglethreadworkqueue and not checked the ret value, which may return NULL. And a null-ptr-deref may happen: cwbatprobe...

alerter (>=0.3.0, <=0.3.2), crate_glitch (0.2.0) +14 more potentially affected by CVE-2025-66622 via matrix-sdk-base (>=0.1.0, <=0.5.1)

matrix-sdk-base CARGO version =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0-beta.1, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.1.10-alpha, =0.13.0, =0.13.1 and more Source cves: CVE-2025-66622 Source advisory: OSV:GHSA-JJ6P-3M75-G2P3...

@regis-samurai/n8n (>=0.216.1, <=0.219.1), n8n-nodes-accelo (>=0.1.0, <=0.1.9) +8 more potentially affected by CVE-2025-65964 via n8n (>=0.138.0, <=0.219.1)

n8n NPM version =0.138.0, =0.216.1, =0.1.0, =0.18.0, =0.1.0, =0.1.0, =0.2.14, =0.1.0, =0.1.0, =0.1.7 Source cves: CVE-2025-65964 Source advisory: OSV:GHSA-WPQC-H9WP-CHMQ...

@andrewcturing/todoist (0.0.1), @bento-core/navigator (1.0.0) +57 more potentially affected by CVE-2026-9673 via json-2-csv (>=3.20.0, <=5.5.10)

json-2-csv NPM version =3.20.0, =1.8.0, =5.0.2, =0.0.1, =0.2.3, =0.1.0, =0.1.0, =0.5.1, =1.0.2, =1.3.1, =1.3.1-next.0, =1.4.0, =2.0.1 and more Source cves: CVE-2026-9673 Source advisory: SNYK:JS-JSON2CSV-14221326...

EUVD-2025-201327

Malicious code in react-svg-fill npm...

5 Threats That Reshaped Web Security This Year [2025]

As 2025 draws to a close, security professionals face a sobering realization: the traditional playbook for web security has become dangerously obsolete. AI-powered attacks, evolving injection techniques, and supply chain compromises affecting hundreds of thousands of websites forced a fundamental...

USN-7909-2 linux-intel-iot-realtime, linux-realtime vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - ARM64 architecture; - MIPS architecture; - PowerPC architecture; - RISC-V architecture; - S39...

@toolsdk.ai/registry (1.0.83) potentially affected by CVE-2025-66404 via mcp-server-kubernetes (2.4.3)

mcp-server-kubernetes NPM version 2.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on mcp-server-kubernetes and may be impacted: - @toolsdk.ai/registry 1.0.83 Source cves: CVE-2025-66404 Source advisory: OSV:GHSA-WVXP-JP4W-W8WG...

EUVD-2025-201049

Malicious code in elf-stats-tinsel-train-397 npm...

MAL-2025-192124 Malicious code in elf-stats-rooftop-hammer-580 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00f8e0b61802c2ebee9fe5ddb54aee5ab39d5cd53e658b235a4543c99e91e383 The package elf-stats-rooftop-hammer-580 was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-200932

Malicious code in elf-stats-evergreen-bow-653 npm...

Malicious code in elf-stats-merry-chimney-765 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0435e21ddce3b9d114ac17bbe0bcb5977f29f67aed49768c7273851c2f70b703 The package elf-stats-merry-chimney-765 was found to contain malicious code...

Attackers Don’t Need to Breach Your API -They’ll Breach the Tools That Touch It

The API supply chain is the new security blind spot. Attackers no longer need to breach your APIs directly; they can target the third-party services that connect to them. These unmanaged dependencies are now the shortest path to your sensitive data. The recent Mixpanel incident is a stark reminde...

Picklescan Bugs Allow Malicious PyTorch Models to Evade Scans and Execute Code

Three critical security flaws have been disclosed in an open-source utility called Picklescan that could allow malicious actors to execute arbitrary code by loading untrusted PyTorch models, effectively bypassing the tool's protections. Picklescan, developed and maintained by Matthieu Maitre...

A Comprehensive Study on the Impact of Vulnerable Dependencies on Open-Source Software

Open-source libraries are widely used by software developers to speed up the development of products, however, they can introduce security vulnerabilities, leading to incidents like Log4Shell. With the expanding usage of open-source libraries, it becomes even more imperative to comprehend and...

GlassWorm Returns with 24 Malicious Extensions Impersonating Popular Developer Tools

The supply chain campaign known as GlassWorm has once again reared its head, infiltrating both Microsoft Visual Studio Marketplace and Open VSX with 24 extensions impersonating popular developer tools and frameworks like Flutter, React, Tailwind, Vim, and Vue. GlassWorm was first documented in...

CVE-2025-65112

PubNet is a self-hosted Dart & Flutter package service. Prior to version 1.1.3, the /api/storage/upload endpoint in PubNet allows unauthenticated users to upload packages as any user by providing arbitrary author-id values. This enables identity spoofing, privilege escalation, and supply chain...

S3C2 SICP Summit 2025-06: Vulnerability Response Summit

Recent years have shown increased cyber attacks targeting less secure elements in the software supply chain and causing significant damage to businesses and organizations. The US and EU governments and industry are equally interested in enhancing software security, including supply chain and...

Shai-Hulud 2.0 Aftermath: Trends, Victimology and Impact

A deeper look at the Shai-Hulud 2.0 supply chain attack: reviewing the infection spread, victimology, leaked secrets distribution, and community response so far...

⚡ Weekly Recap: Hot CVEs, npm Worm Returns, Firefox RCE, M365 Email Raid & More

Hackers aren't kicking down the door anymore. They just use the same tools we use every day — code packages, cloud accounts, email, chat, phones, and "trusted" partners — and turn them against us. One bad download can leak your keys. One weak vendor can expose many customers at once. One guest...