Decision Insights Threat Desk

LangChainGo has a vulnerability, CVE-2025-9556, allowing arbitrary file reads through the Gonja template engine, exposing files.

NPM supply chain compromise revealed on Sept. 15, 2025, impacts over 500 packages with malware Shai-Hulud and credential theft.

Draytek reports a remote code execution vulnerability in Vigor routers' EasyVPN and LAN web interface, enabling command injection.

Kiwire Captive Portal by SynchroWeb has three vulnerabilities, including SQL injection, open redirection, and XSS.

An attacker could misuse Clevo's leaked keys to sign malicious firmware, compromising systems using Clevo's firmware.

A DNS rebinding attack combined with CORS manipulation can lead to unauthorized access to sensitive data across private networks.