Open Source Security

30-Year-Old Bug: High-Severity libpng Flaw (CVSS 8.3) Exposes Millions of Apps

• Vulnerability Report

30-Year-Old Bug: High-Severity libpng Flaw (CVSS 8.3) Exposes Millions of Apps

Do Son February 10, 2026 0

A 30-year-old heap overflow in libpng (CVE-2026-25646) exposes apps to DoS & RCE. The flaw affects all versions since inception. Update to v1.6.55 now.

Identity at Risk: Apache Syncope Patches Critical Login XSS & XXE Flaws

• Vulnerability Report

Identity at Risk: Apache Syncope Patches Critical Login XSS & XXE Flaws

Do Son February 3, 2026 0

Apache patches XSS (CVE-2026-23794) & XXE flaws in Syncope. Vulnerability allows session hijacking via login page. Update to v3.0.16 or v4.0.4 now.

Notepad++ Hijacked: State-Sponsored Actors Poisoned Updates for Months

• Cyber Security

Notepad++ Hijacked: State-Sponsored Actors Poisoned Updates for Months

Do Son February 2, 2026 0

Notepad++ confirms update infrastructure was compromised by state-sponsored actors targeting specific users. Update to version 8.8.9 immediately.

“Repo Squatting”: How Hackers Are Using GitHub’s Own Features to Hijack Official Repos

• Cybercriminals

“Repo Squatting”: How Hackers Are Using GitHub’s Own Features to Hijack Official Repos

Do Son January 27, 2026 0

Attackers exploit GitHub forks ("Repo Squatting") to push HijackLoader malware via official-looking URLs. Technique remains active; verify all downloads.

Public Yet Private? Critical Appsmith Flaw Exposes Unpublished Actions (CVSS 9.4)

• Vulnerability Report

Public Yet Private? Critical Appsmith Flaw Exposes Unpublished Actions (CVSS 9.4)

Do Son January 23, 2026 0

Critical Appsmith flaw CVE-2026-24042 (CVSS 9.4) allows public users to execute private, unpublished actions. Update to v1.95 now to secure your apps.

CVE-2026-0622: Hardcoded Secret Exposes Open5GS 5G Core Networks

• Vulnerability Report

CVE-2026-0622: Hardcoded Secret Exposes Open5GS 5G Core Networks

Do Son January 22, 2026 0

Open5GS WebUI vulnerability CVE-2026-0622 uses the default secret "change-me," allowing attackers to forge admin tokens. Patch now or update your keys.

CVE-2025-65586: Libheif Flaw Exposes Image Decoders to Denial-of-Service

• Vulnerability Report

CVE-2025-65586: Libheif Flaw Exposes Image Decoders to Denial-of-Service

Do Son January 21, 2026 0

libheif flaw CVE-2025-65586 causes app crashes via malformed HEIF images. Update to v1.21.0 now to prevent Denial of Service attacks.

Crypto Foundation Cracked: One-Byte Overflow in GNU libtasn1 (CVE-2025-13151)

• Vulnerability Report

Crypto Foundation Cracked: One-Byte Overflow in GNU libtasn1 (CVE-2025-13151)

Do Son January 21, 2026 0

CVE-2025-13151: A one-byte overflow in GNU libtasn1 risks memory corruption during cert parsing. Patch now to secure your cryptographic applications.

Search Engine Exposed: Apache Solr Flaws Leak Data & Bypass Auth

• Vulnerability Report

Search Engine Exposed: Apache Solr Flaws Leak Data & Bypass Auth

Do Son January 21, 2026 0

Apache Solr patches moderate flaws CVE-2026-22444 & CVE-2026-22022. Vulnerabilities risk NTLM hash leaks and auth bypass. Update to v9.10.1 now.

One API Call to Hijack: Critical Cal.com Flaw (CVE-2026-23478, CVSS 10) Bypasses 2FA

• Vulnerability Report

One API Call to Hijack: Critical Cal.com Flaw (CVE-2026-23478, CVSS 10) Bypasses 2FA

Do Son January 15, 2026 0

Critical Cal.com flaw (CVE-2026-23478) allows full account takeover via a single API call. CVSS 10.0. Update self-hosted instances to v6.0.7 immediately.

Critical Appsmith Flaw CVE-2026-22794 Allows Account Takeover

• Vulnerability Report

Critical Appsmith Flaw CVE-2026-22794 Allows Account Takeover

Do Son January 14, 2026 0

Critical Appsmith flaw CVE-2026-22794 (CVSS 9.7) allows account takeover via Host Header Injection. Update to v1.93 immediately to secure your data.

CVE-2026-22184 (CVSS 9.3): Critical zlib Flaw Opens Door to Global Buffer Overflow

• Vulnerability Report

CVE-2026-22184 (CVSS 9.3): Critical zlib Flaw Opens Door to Global Buffer Overflow

Do Son January 12, 2026 0

Critical zlib flaw CVE-2026-22184 (CVSS 9.3) allows RCE via buffer overflow in the untgz utility. Update to version 1.3.1.2 immediately to secure systems.

Critical Wget2 Flaws Expose Users to Arbitrary File Overwrites and Memory Crashes

• Vulnerability Report

Critical Wget2 Flaws Expose Users to Arbitrary File Overwrites and Memory Crashes

Do Son January 2, 2026 0

GNU Wget2 flaws (CVE-2025-69194 & 69195) allow attackers to overwrite files and crash systems via malicious downloads. Update your tools immediately!

CVE-2025-47411: Critical Apache StreamPipes Flaw Allows Standard Users to Seize Admin Control

• Vulnerability Report

CVE-2025-47411: Critical Apache StreamPipes Flaw Allows Standard Users to Seize Admin Control

Do Son December 31, 2025 0

Apache StreamPipes patches CVE-2025-47411, a logic flaw allowing users to manipulate JWT tokens and hijack admin accounts. Update to v0.98.0 now!

“LotusBail” Trap: 56,000 Developers Downloaded a Fake WhatsApp API That Works perfectly—While Stealing Everything

• Malware

“LotusBail” Trap: 56,000 Developers Downloaded a Fake WhatsApp API That Works perfectly—While Stealing Everything

Do Son December 25, 2025 0

Koi Security uncovers lotusbail, a malicious npm package with 56k downloads that functions perfectly while stealing WhatsApp credentials and chats.

CVE-2025-59789: Critical Flaw in Apache bRPC Framework Exposes High-Performance Systems to Crash Risks

• Vulnerability Report

CVE-2025-59789: Critical Flaw in Apache bRPC Framework Exposes High-Performance Systems to Crash Risks

Do Son December 1, 2025 0

A critical vulnerability in Apache bRPC (CVE-2025-59789) allows attackers to crash servers using deep JSON data. Upgrade to version 1.15.0 now to fix it.

PyPI Malware Alert: Malicious ‘solana-token’ Package Targets Solana Developers

• Malware

PyPI Malware Alert: Malicious ‘solana-token’ Package Targets Solana Developers

Do Son May 15, 2025 0

A malicious PyPI package named 'solana-token' targeted Solana developers to steal code and secrets. Learn how it worked and how to stay safe.

Critical Open Source Library ‘easyjson’ Linked to Russian VK Group

• Cyber Security

Critical Open Source Library ‘easyjson’ Linked to Russian VK Group

Do Son May 7, 2025 0

Research reveals the widely used open source library 'easyjson' is controlled by developers linked to Russia's VK Group, raising security concerns.

CVE-2025-32444 (CVSS 10): Critical RCE Flaw in vLLM’s Mooncake Integration Exposes AI Infrastructure

• Vulnerability

CVE-2025-32444 (CVSS 10): Critical RCE Flaw in vLLM’s Mooncake Integration Exposes AI Infrastructure

Do Son May 1, 2025 0

CVE-2025-32444 exposes vLLM’s Mooncake integration to RCE via insecure pickle deserialization over ZeroMQ. Patch to v0.8.5 now.

Malicious Packages Stealing Crypto Credentials: A Warning for Developers

• Malware

Malicious Packages Stealing Crypto Credentials: A Warning for Developers

Do Son April 23, 2025 0

Malicious open-source packages are stealing crypto wallet credentials! Learn about the threat and how to protect your seed phrases and private keys.

Top Cybersecurity Tools for 2025

• Open Source Tool

Top Cybersecurity Tools for 2025

Do Son April 16, 2025 0

A curated list of the top cybersecurity tools for 2025, covering reconnaissance, wireless hacking, password cracking, forensics, and more.

Critical Remote Code Execution Vulnerability in vLLM via Mooncake Integration

• Vulnerability

Critical Remote Code Execution Vulnerability in vLLM via Mooncake Integration

Do Son March 24, 2025 0

Learn about CVE-2025-29783, a critical vulnerability in vLLM affecting LLM deployments and remote code execution risks.