ModulithShop 信任管理问题漏洞

ModulithShop is an online shopping mall system from the individual developers of Shopsuite. ModulithShop suffers from a Trust Management Issue vulnerability that stems from misbehavior of the component RSA/OAuth2/Database, which could lead to hard-coded credentials...

CVE-2025-8855

Authorization Bypass Through User-Controlled Key, Weak Password Recovery Mechanism for Forgotten Password, Authentication Bypass by Assumed-Immutable Data vulnerability in Optimus Software Brokerage Automation allows Exploiting Trust in Client, Authentication Bypass, Manipulate Registry...

GHSA-G2J9-G8R5-RG82 PrivateBin's template-switching feature allows arbitrary local file inclusion through path traversal

Summary An unauthenticated Local File Inclusion exists in the template-switching feature: if templateselection is enabled in the configuration, the server trusts the template cookie and includes the referenced PHP file. An attacker can read sensitive data or, if they manage to drop a PHP file...

EUVD-2025-197605

Authorization Bypass Through User-Controlled Key, Weak Password Recovery Mechanism for Forgotten Password, Authentication Bypass by Assumed-Immutable Data vulnerability in Optimus Software Brokerage Automation allows Exploiting Trust in Client, Authentication Bypass, Manipulate Registry...

Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images

Summary Multiple vulnerabilities were addressed in IBM MQ Operator and Queue manager container images Vulnerability Details CVEID:CVE-2025-36047 DESCRIPTION: IBM WebSphere Application Server Liberty 18.0.0.2 through 25.0.0.8 is vulnerable to a denial of service, caused by sending a...

Zero Trust Security for Mission Partner Environments in Coalition Operations

...

CVE-2025-8855 2FA Expiry Bypass in Optimus Software's Brokerage Automation

Authorization Bypass Through User-Controlled Key, Weak Password Recovery Mechanism for Forgotten Password, Authentication Bypass by Assumed-Immutable Data vulnerability in Optimus Software Brokerage Automation allows Exploiting Trust in Client, Authentication Bypass, Manipulate Registry...

CVE-2025-64186

Evervault is a payment security solution. A vulnerability was identified in the evervault-go SDK’s attestation verification logic in versions of evervault-go prior to 1.3.2 that may allow incomplete documents to pass validation. This may cause the client to trust an enclave operator that does not...

Linux Distros Unpatched Vulnerability : CVE-2025-40181

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP When running as an SNP or TDX guest under KVM, force the legacy PCI hole, i.e. memory...

Malicious code in indea-fodioj-agajonafau (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35fe241d9432e5a1913fa9a6abbb308f5b0c73fdeec93ca8409cd548bfa32e66 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-40181

In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP When running as an SNP or TDX guest under KVM, force the legacy PCI hole, i.e. memory between Top of Lower Usable DRAM and 4GiB, to be mapped as UC via a forc...

CVE-2025-40181

In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP When running as an SNP or TDX guest under KVM, force the legacy PCI hole, i.e. memory between Top of Lower Usable DRAM and 4GiB, to be mapped as UC via a forc...

Malicious code in lookingan-nalako98 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b60c9fcd95cd993c92436cacd87324d243f4c586647a0868a70bd969348b403e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ultra-terser-capella-tethys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b1313e3e3f93703b6b22a59de9916d11ccb6378d4b340b02f531a428f1b8515 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142114 Malicious code in epimetheus-zephyr-cygnus-cypress (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 126408fe26e034015b137d865bf1fb63593a019521549e408cbab133a62fd25d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Evervault Go SDK 数据伪造问题漏洞

Evervault Go SDK is an open source development toolkit from Evervault. A Data Forgery Issue vulnerability exists in Evervault Go SDK versions prior to 1.3.2, which stems from incomplete validation logic that could lead to trusting an enclave operator that does not meet integrity guarantees...

Malicious code in vina-nasiuduk21-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52bfde403c18a9ae732d58e17b4fea56dd327b38445cdd1c3919396f72f2ba1a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

kernel: x86/tdx: Fix "in-kernel MMIO" check

A flaw was found in the Linux kernel. Userspace can deceive the kernel into performing MMIO Memory-Mapped IO operations in TDX Trust Domain Extensions on its behalf, allowing a VE Virtualization Exception to be incorrectly handled as a in-kernel MMIO operation...

MAL-2025-110593 Malicious code in vitreous_camel_dumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 239bdfe43105e45117afe9fbe176eb5e44767e696ae4fe09dc765d9a80077bf2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in entire_panda_dumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8b7f299adfaac9264558e13146b847616615e1f07eba90bf54a9d6b3c6437b9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...