ExtensionGraphQl

Infostealer campaign compromises 10 npm packages, targets devs

Chinese FamousSparrow hackers deploy upgraded malware in attacks

Windows 11 KB5053656 update released with 38 changes and fixes

Microsoft: New Windows scheduled task will launch Office apps faster

New Morphing Meerkat Phishing Kit Mimics 114 Brands Using Victims' DNS Email Records

The 4 WordPress flaws hackers targeted the most in Q1 2025

Mozilla warns Windows users of critical Firefox sandbox escape flaw

WhatsApp's Meta AI is now rolling out in Europe, and it can't be turned off

Hackers Repurpose RansomHub's EDRKillShifter in Medusa, BianLian, and Play Attacks

Recent Windows Server 2025 updates cause Remote Desktop freezes

CVE-2020-29574 CyberoamOS (CROS) SQL Injection Vulnerability

CVE-2024-49035 Microsoft Partner Center Improper Access Control Vulnerability

CVE-2022-43939 Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability

CVE-2024-20953 Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability

CVE-2024-41710 Mitel SIP Phones Argument Injection Vulnerability

CVE-2025-22224 VMware ESXi and Workstation TOCTOU Race Condition Vulnerability

CVE-2025-0111 Palo Alto Networks PAN-OS File Read Vulnerability

CVE-2022-43769 Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability

CVE-2018-8639 Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability

CVE-2018-19410 Paessler PRTG Network Monitor Local File Inclusion Vulnerability

CSP

Content Security Policy (CSP) Header Not Set

MediumAbsence of Anti-CSRF Tokens

InformationalInformation Disclosure - Suspicious Comments

LowCross-Domain JavaScript Source File Inclusion

MediumMissing Anti-clickjacking Header

MediumContent Security Policy (CSP) Header Not Set

LowTimestamp Disclosure - Unix

InformationalRe-examine Cache-control Directives

LowCSP: X-Content-Security-Policy

HighCWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CWE-1426 Improper Validation of Generative AI Output

CWE-693 Protection Mechanism Failure

CWE-1091 Use of Object without Invoking Destructor Method

CWE-1173 Improper Use of Validation Framework

CWE-1230 Exposure of Sensitive Information Through Metadata

CWE-1053 Missing Documentation for Design

CWE-1064 Invokable Control Element with Signature Containing an Excessive Number of Parameters

CWE-1099 Inconsistent Naming Conventions for Identifiers

CWE-1125 Excessive Attack Surface