Decision Insights Threat Desk

A supply chain attack on NPM has compromised over 500 packages using credential theft and self-propagating malware.

Draytek Vigor routers with DrayOS firmware have a remote code execution flaw in EasyVPN and LAN interfaces enabling attacker control.

Kiwire Captive Portal vulnerabilities include SQL injection, open redirection, and XSS; vendor released fixes are available.

Clevo's UEFI firmware leaked private Boot Guard keys, risking pre-boot firmware integrity on affected systems.

A vulnerability in browsers allows DNS rebinding and CORS header manipulation to enable unauthorized data access.

Password managers in browser extensions face DOM-based clickjacking risks that may expose stored credentials during autofill.