A week in security (November 17 – November 23)

Last week on Malwarebytes Labs: AI teddy bear for kids responds with sexual content and advice about weapons Fake calendar invites are spreading. Here’s how to remove them and prevent more Budget Samsung phones shipped with unremovable spyware, say researchers What the Flock is happening with...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989069)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989069 advisory. In the Linux kernel, the following vulnerability has been resolved: media: irtoy: free before error exiting Fix leak in error path. Tenable has extracted the precedi...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987634)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987634 advisory. In the Linux kernel, the following vulnerability has been resolved: media: irtoy: free before error exiting Fix leak in error path. Tenable has extracted the precedi...

EUVD-2015-8157

Malware in sbrugna...

EUVD-2024-37897

Malicious code in bioql PyPI...

CVE-2024-39313

toy-blog is a headless content management system implementation. Starting in version 0.5.4 and prior to version 0.6.1, articles with private visibility can be read if the reader does not set credentials for the request. Users should upgrade to 0.6.1 or later to receive a patch. No known workaroun...

SUSE CVE-2021-47643

In the Linux kernel, the following vulnerability has been resolved: media: irtoy: free before error exiting Fix leak in error path...

DEBIAN-CVE-2021-47643

In the Linux kernel, the following vulnerability has been resolved: media: irtoy: free before error exiting Fix leak in error path...

UBUNTU-CVE-2021-47643

In the Linux kernel, the following vulnerability has been resolved: media: irtoy: free before error exiting Fix leak in error path...

totally-safe-transmute allows transmuting any type to any other type in safe Rust

This crate is a toy and should never be used. It showcases a known soundness issue https://github.com/rust-lang/rust/issues/32670 that will never get fixed. In short, Linux provides a file called /proc/self/mem which can be used by a program to modify its own memory. This library modifies an enum...

PT-2025-19819 · Crates.Io · Totally-Safe-Transmute

This crate is a toy and should never be used. It showcases a known soundness issue https://github.com/rust-lang/rust/issues/32670 that will never get fixed. In short, Linux provides a file called /proc/self/mem which can be used by a program to modify its own memory. This library modifies an enum...

Temu must respect consumer protection laws, says EU

Temu has been accused of a number of infringements on its platform against European Union EU consumer law. The Consumer Protection Cooperation CPC Network of national consumer authorities and the European Commission teamed up for a coordinated ongoing investigation into Temu and its practices. Th...

CVE-2024-39314 toy-blog administrative token leaked through the command line parameter

toy-blog is a headless content management system implementation. Starting in version 0.4.3 and prior to version 0.5.0, the administrative password was leaked through the command line parameter. The problem was patched in version 0.5.0. As a workaround, pass --read-bearer-token-from-stdin to the...

CVE-2024-39314 toy-blog administrative token leaked through the command line parameter

toy-blog is a headless content management system implementation. Starting in version 0.4.3 and prior to version 0.5.0, the administrative password was leaked through the command line parameter. The problem was patched in version 0.5.0. As a workaround, pass --read-bearer-token-from-stdin to the...

CVE-2024-39314 toy-blog administrative token leaked through the command line parameter

toy-blog is a headless content management system implementation. Starting in version 0.4.3 and prior to version 0.5.0, the administrative password was leaked through the command line parameter. The problem was patched in version 0.5.0. As a workaround, pass --read-bearer-token-from-stdin to the...

CVE-2024-39313 toy-blog Improper Input Validation vulnerability

toy-blog is a headless content management system implementation. Starting in version 0.5.4 and prior to version 0.6.1, articles with private visibility can be read if the reader does not set credentials for the request. Users should upgrade to 0.6.1 or later to receive a patch. No known workaroun...

CVE-2024-39313 toy-blog Improper Input Validation vulnerability

toy-blog is a headless content management system implementation. Starting in version 0.5.4 and prior to version 0.6.1, articles with private visibility can be read if the reader does not set credentials for the request. Users should upgrade to 0.6.1 or later to receive a patch. No known workaroun...

CVE-2024-39313

Summary: CVE-2024-39313 affects toy-blog before 0.6.1, where articles with private visibility could be read without providing credentials. The root cause is improper access control for private posts. Impact is unauthorized disclosure of private content (permitted read is described as the primary ...

CVE-2024-39313 toy-blog Improper Input Validation vulnerability

toy-blog is a headless content management system implementation. Starting in version 0.5.4 and prior to version 0.6.1, articles with private visibility can be read if the reader does not set credentials for the request. Users should upgrade to 0.6.1 or later to receive a patch. No known workaroun...

PT-2024-28437 · Toy-Blog · Toy-Blog

Name of the Vulnerable Software and Affected Versions: toy-blog versions 0.5.4 through 0.6.0 Description: The issue allows articles with private visibility to be read without proper credentials. This can lead to unauthorized access to sensitive information. Users are advised to upgrade to a newer...