5779 matches found
PT-2025-52379
Name of the Vulnerable Software and Affected Versions Hugging Face Transformers affected versions not specified Description A flaw exists in Hugging Face Transformers due to insufficient validation of user-supplied data during the parsing of model files. This can lead to the deserialization of...
PT-2025-52386
Name of the Vulnerable Software and Affected Versions Hugging Face Transformers affected versions not specified Description A flaw exists in Hugging Face Transformers related to the parsing of checkpoints, allowing remote attackers to execute arbitrary code. The issue stems from insufficient...
Libbiosig, Grassroot DiCoM, Smallstep step-ca vulnerabilities
Cisco Talos' Vulnerability Discovery & Research team recently disclosed vulnerabilities in Biosig Project Libbiosig, Grassroot DiCoM, and Smallstep step-ca. The vulnerabilities mentioned in this blog post have been patched by their respective vendors, all in adherence to Cisco 's third-party...
New ForumTroll Phishing Attacks Target Russian Scholars Using Fake eLibrary Emails
The threat actor linked to Operation ForumTroll has been attributed to a fresh set of phishing attacks targeting individuals within Russia, according to Kaspersky. The Russian cybersecurity vendor said it detected the new activity in October 2025. The origins of the threat actor are presently...
CVE-2025-14424
creationtimestamp| type| source ---|---|--- 2025-12-17 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-1138/...
CVE-2025-14423
creationtimestamp| type| source ---|---|--- 2025-12-17 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-1137/...
CVE-2025-14422
creationtimestamp| type| source ---|---|--- 2025-12-17 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-1136/ 2026-01-05 15:42:32+00:00| seen| https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mbornzhm7k2c...
CVE-2025-14501
creationtimestamp| type| source ---|---|--- 2025-12-17 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-1104/...
PT-2025-51891
Name of the Vulnerable Software and Affected Versions SonicWall SMA1000 versions prior to 12.4.3-03245 and 12.5.0-02283 SonicWall SMA 100 series appliances affected versions not specified Description A local privilege escalation vulnerability exists in the SonicWall SMA1000 appliance management...
IE Mode: A Window to the Web – or to Attackers?
Running short on time but still want to stay in the know? Well, we’ve got you covered! We’ve condensed all the key takeaways into a handy audio summary. Our AI-driven podcasts are fit for on the go. Recently, Internet Explorer IE Mode has been weaponized by threat actors through multiple zero-day...
An Empirical Analysis of Zero-Day Vulnerabilities Disclosed by the Zero Day Initiative
Zero-day vulnerabilities represent some of the most critical threats in cybersecurity, as they correspond to previously unknown flaws in software or hardware that are actively exploited before vendors can develop and deploy patches. During this exposure window, affected systems remain defenseless...
Welcome to the new Project Zero Blog
Posted by Natalie Silvanovich While on Project Zero, we aim for our research to be leading-edge, our blog design was … not so much. We welcome readers to our shiny new blog! For the occasion, we asked members of Project Zero to dust off old blog posts that never quite saw the light of day. And...
⚡ Weekly Recap: Apple 0-Days, WinRAR Exploit, LastPass Fines, .NET RCE, OAuth Scams & More
If you use a smartphone, browse the web, or unzip files on your computer, you are in the crosshairs this week. Hackers are currently exploiting critical flaws in the daily software we all rely on—and in some cases, they started attacking before a fix was even ready. Below, we list the urgent...
A week in security (December 8 – December 14)
Last week on Malwarebytes Labs: The US digital doxxing of H-1B applicants is a massive privacy misstep Google ads funnel Mac users to poisoned AI chats that spread the AMOS infostealer How private is your VPN? DroidLock malware locks you out of your Android device and demands ransom Malwarebytes...
PT-2025-51095
🚨 Google Chrome Eighth Zero-Day Vulnerability CVE-2025-7499109 Advisory High Dec 13, 2025 Checkout our Threat Intelligence Platform: https://t.co/QuwNtEgYh1 https://t.co/QuwNtEgYh1 ThreatIntelligence CyberSecurity Innovation LLM https://t.co/yHTrc16kSs...
PT-2025-51037
Name of the Vulnerable Software and Affected Versions Safari versions prior to 26.2 iOS versions prior to 18.7.3 iPadOS versions prior to 18.7.3 iOS versions prior to 26.2 iPadOS versions prior to 26.2 macOS Tahoe versions prior to 26.2 tvOS versions prior to 26.2 visionOS versions prior to 26.2...
AIs Exploiting Smart Contracts
I have long maintained that smart contracts are a dumb idea: that a human process is actually a security feature. Here's some interesting research on training AIs to automatically exploit smart contracts: AI models are increasingly good at cyber tasks, as we've written about before. But what is t...
Unpatched Gogs Zero-Day Exploited Across 700+ Instances Amid Active Attacks
A high-severity unpatched security vulnerability in Gogs has come under active exploitation, with more than 700 compromised instances accessible over the internet, according to new findings from Wiz. The flaw, tracked as CVE-2025-8110 CVSS score: 8.7, is a case of file overwrite in the file updat...
Chrome Targeted by Active In-the-Wild Exploit Tied to Undisclosed High-Severity Flaw
Google on Wednesday shipped security updates for its Chrome browser to address three security flaws, including one it said has come under active exploitation in the wild. The vulnerability, rated high in severity, is being tracked under the Chromium issue tracker ID "466192044." Unlike other...