SectionVulnerabilities
Patches, advisories and the CVEs behind them.
European Parliament Revives CSAM Scanning Law Amid Procedural Controversy
A last-minute vote using an unusual absolute-majority procedure has extended legal cover for voluntary CSAM scanning by tech platforms through 2028, even…
Malicious jscrambler npm Package Drops Rust Infostealer at Install Time
A compromised 8.14.0 release of the jscrambler npm package used a preinstall hook to silently execute native infostealer binaries on Windows, macOS,…
Six U-Boot Flaws Could Let Attackers Hijack Devices Before the OS Even Loads
Firmware security firm Binarly has disclosed six vulnerabilities in U-Boot's image signature verification code, two of which allow arbitrary code execution during…
Critical Zimbra Classic Web Client Flaw Lets Emails Execute Malicious Code
Zimbra is pushing urgent updates for a critical stored XSS vulnerability in its Classic Web Client that lets specially crafted emails run…
Zimbra Patches Critical XSS Flaw in Classic Web Client After Google TAG Report
Zimbra has released version 10.1.19 to fix a critical stored XSS vulnerability in its Classic Web Client, flagged by Google's Threat Analysis…
Unpatched XRING Bug in Alibaba’s XQUIC Lets Remote Clients Crash HTTP/3 Servers
A single-line variable error in Alibaba's XQUIC library allows unauthenticated attackers to crash HTTP/3 servers with a short burst of valid QPACK…
Three Chained Flaws in OpenClaw AI Assistant Enabled WhatsApp-to-Host Takeover
A researcher has disclosed details of three now-patched, high-severity vulnerabilities in the OpenClaw personal AI assistant that could be chained from a…
Weekly Roundup: DHS Database Breach, Adobe Speeds Up Patches, Canada Disrupts Ransomware Infrastructure
This week's roundup covers a breach of a DHS interagency network, Adobe's move to twice-monthly patch releases, Canadian intelligence operations against ransomware…
Progress Tells ShareFile Storage Zone Controller Customers to Shut Down Servers Now
Progress Software has disabled cloud access to on-premises ShareFile Storage Zone Controllers and is urging customers to manually power down affected Windows…
Dutch Police Suspect Local Hackers Behind Odido Vishing Breach
Dutch National Police say they have found strong indications that Dutch-speaking hackers used a vishing call to Odido's customer service to trigger…
npm 12 Disables Install Scripts by Default to Cut Supply Chain Risk
GitHub has shipped npm 12 with install scripts turned off by default and has deprecated granular access tokens that could bypass two-factor…
Injective Labs npm SDK Backdoored to Steal Crypto Wallet Keys
Attackers compromised a contributor's GitHub account to publish a malicious version of the @injectivelabs/sdk-ts package, silently harvesting private keys and seed phrases…