EUVD-2025-5504

Malicious code in bioql PyPI...

EUVD-2024-38211

Malicious code in bioql PyPI...

EUVD-2022-37265

Malicious code in bioql PyPI...

PT-2025-40613

Name of the Vulnerable Software and Affected Versions ManageEngine Analytics Plus versions 6171 and prior Description The software is susceptible to authenticated SQL Injection through the key update API. The API endpoint is vulnerable due to improper input validation, potentially allowing an...

CVE-2025-34192

Vasion Print formerly PrinterLogic Virtual Appliance Host versions prior to 22.0.893 and Application versions prior to 20.0.2140 macOS/Linux client deployments are built against OpenSSL 1.0.2h-fips released May 2016, which has been end-of-life since 2019 and is no longer supported by the OpenSSL...

CVE-2025-34192

Vasion Print formerly PrinterLogic Virtual Appliance Host versions prior to 22.0.893 and Application versions prior to 20.0.2140 macOS/Linux client deployments are built against OpenSSL 1.0.2h-fips released May 2016, which has been end-of-life since 2019 and is no longer supported by the OpenSSL...

The vulnerability of the cloud-based platform for managing and protecting Microsoft Entra ID (formerly Azure Active Directory) relates to authentication procedures that allow attackers to escalate their privileges.

The vulnerability of the cloud-based platform for managing and protecting Microsoft Entra ID formerly Azure Active Directory is related to authentication procedures’ deficiencies. Exploiting this vulnerability could allow attackers to increase their privileges remotely...

The vulnerability of the Samsung Gallery mobile application for Android operating systems on Samsung mobile devices allows a hacker to circumvent existing security restrictions and gain unauthorized access to the application.

The vulnerability of the Samsung Gallery mobile application for Android operating systems and Samsung mobile devices is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to circumvent existing security restrictions and gain unauthorized access to the...

Fedora 42 : libssh (2025-9826857157)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-9826857157 advisory. New upstream release fixing the following security weaknesses CVE-2025-8114, CVE-2025-8277 Tenable has extracted the preceding description block...

CWEXploit

This is a PoC Proof of Concept exploit for various CWE Common...

The vulnerability of the VirtKey function in the configuration management system and the remote execution of Salt operations allows a perpetrator to circumvent established security restrictions.

The vulnerability of the VirtKey function in the configuration management system and the ability to perform remote Salt operations are related to deficiencies in the authentication process. Exploiting this vulnerability can allow attackers to circumvent established security restrictions...

The vulnerability of the microprogramming software used in the RUGGEDCOM routing and switching platform, which stems from the use of cryptographic algorithms containing defects, allows attackers to execute “man-in-the-middle” attacks.

The vulnerability of the microprogramming software used in the RUGGEDCOM routing and switching platform is related to the use of cryptographic algorithms that contain vulnerabilities. Exploiting this vulnerability could allow a remote attacker to execute a “man-in-the-middle” type attack...

ROS-20250828-04

A vulnerability in the Moodle virtual learning environment is related to insufficient cleanup of data provided by the by the user in the calendar event header when the event is deleted. Exploitation of the vulnerability could allow A remote attacker to perform cross-site scripting attacks A...

postMessaged and Compromised

At Microsoft, securing the ecosystem means more than just fixing bugs—it means proactively hunting for variant classes, identifying systemic weaknesses, and working across teams to protect customers before attackers ever get the chance. This blog highlights one such effort: a deep dive into the...

User Impersonation

Overview Affected versions of this package are vulnerable to User Impersonation due to insufficient authentication checks in the client and server processes. An attacker can gain unauthorized access to sensitive data by establishing a connection without proper certificate validation or...

IBM 2025 Cost of a Data Breach Report: Lessons for API and AI Security

IBM’s 2025 Cost of a Data Breach Report offers one of the clearest and most comprehensive views yet of how AI adoption is shaping the security landscape. While breach numbers are relatively low – only 13% of organizations reported breaches involving AI models or applications – the report reveals ...

It Looks Like a School Bathroom Smoke Detector. A Teen Hacker Showed It Could Be an Audio Bug

A pair of hackers found that a vape detector often found in high school bathrooms contained microphones—and security weaknesses that could allow someone to turn it into a secret listening device...

The vulnerability of PackageKit for macOS operating systems, which allows a hacker to trigger a service failure.

The vulnerability of PackageKit for macOS operating systems is related to access control deficiencies. Exploiting this vulnerability can allow an attacker to cause service failures...

Encryption Made for Police and Military Radios May Be Easily Cracked

Researchers found that an encryption algorithm likely used by law enforcement and special forces can have weaknesses that could allow an attacker to listen in...

AI wrote my code and all I got was this broken prototype

Welcome to this week's edition of the Threat Source newsletter. Vulnerabilities within software are a persistent challenge. Software engineers inadvertently tend to make the same mistakes repeatedly, with the same entries appearing in the annual top 25 list of Common Weakness Enumerations each...