THREAT OPS › Threat News

Threat Intelligence News

12257 reports from 110+ open cyber-threat-intelligence sources — APT activity, malware, vulnerabilities and campaigns, newest first.

[NVD] CVE-2025-13823 — A security issue was found in the IPv6 stack in the Micro850 and Micro870 controllers when the controllers received multiple malformed packets during fuzzing. The controllers will go into recoverable fault with fault code 0xFE60. To recover the controller, clear the fault.nvd · 2025-12-15
[NVD] CVE-2025-14512 (MEDIUM 6.5) — A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib's GIO (GLib Input/Output) escape_byte_string() function when processing malicious file or remote filesystem attribute values.nvd · 2025-12-11
HTTPS certificate industry phasing out less secure domain validation methodsgoogle_security · 2025-12-10
Introducing Saved Searches in Google Threat Intelligence (GTI) and VirusTotal (VT): Enhance Collaboration and Efficiencyvirustotal_blog · 2025-12-10
[NVD] CVE-2025-14087 (MEDIUM 5.6) — A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings.nvd · 2025-12-10
[NVD] CVE-2025-61813 (HIGH 7.4) — ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files on the sernvd · 2025-12-10
[NVD] CVE-2025-12945 (LOW 2.4) — An improper input validation vulnerability in the NETGEAR Nighthawk R7000P (end of service) routers lets an authenticated administrator with local network access to the device, to execute OS command injections and make unauthorized modifications to the router software and functionvd · 2025-12-09
Further Hardening Android GPUsgoogle_security · 2025-12-09
Architecting Security for Agentic Capabilities in Chromegoogle_security · 2025-12-08
[NVD] CVE-2025-48565 (HIGH 7.8) — In multiple locations, there is a possible way to bypass the cross profile intent filter due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.nvd · 2025-12-08
[NVD] CVE-2025-48564 (HIGH 7.0) — In multiple locations, there is a possible intent filter bypass due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.nvd · 2025-12-08
[NVD] CVE-2022-50627 — In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix monitor mode bringup crash When the interface is brought up in monitor mode, it leads to NULL pointer dereference crash. This crash happens when the packet type is extracted for a SKB. This exnvd · 2025-12-08
[NVD] CVE-2025-40307 (HIGH 7.8) — In the Linux kernel, the following vulnerability has been resolved: exfat: validate cluster allocation bits of the allocation bitmap syzbot created an exfat image with cluster bits not set for the allocation bitmap. exfat-fs reads and uses the allocation bitmap without checkingnvd · 2025-12-08
[Breach] Dragonica Lunaris — 126,293 accounts exposedhibp_breaches · 2025-12-06
[NVD] CVE-2025-14104 (MEDIUM 6.1) — A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.nvd · 2025-12-05
Cybersecurity industry overreacts to React vulnerability, starts panic, burns own house down againdoublepulsar · 2025-12-05
The Normalization of Deviance in AIembracethered · 2025-12-05
[NVD] CVE-2025-6946 (MEDIUM 4.8) — A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the IPS configuration. An authenticated remote attacker with administrator privileges could exploit this vulnerability to execute arbitrary JavaScript code innvd · 2025-12-04
Dangerous Invitations: Russian Threat Actor Spoofs European Security Events in Targeted Phishing Attacksvolexity · 2025-12-04
[NVD] CVE-2025-12385 — Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability in The Qt Company Qt on Windows, MacOS, Linux, iOS, Android, x86, ARM, 64 bit, 32 bit allows Excessive Allocation. This issue affects users of the Text componenvd · 2025-12-03
[NVD] CVE-2024-3884 — A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause an OutOfMemory issunvd · 2025-12-03
Android expands pilot for in-call scam protection for financial appsgoogle_security · 2025-12-03
Small numbers of Notepad++ users reporting security woesdoublepulsar · 2025-12-02
[NVD] CVE-2025-13828 — SummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked. ImpactA low-privileged user of the platform can install malicious code to obtain nvd · 2025-12-02
[NVD] CVE-2025-59703 (CRITICAL 9.1) — Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a Physically Proximate Attacker to access the internal components of the appliance, without leaving tamper evidence. To exploit this, the attacker nvd · 2025-12-02
[NVD] CVE-2025-13877 (MEDIUM 5.6) — A vulnerability was detected in nocobase up to 1.9.4/2.0.0-alpha.37. The affected element is an unknown function of the file nocobase\packages\core\auth\src\base\jwt-service.ts of the component JWT Service. The manipulation of the argument API_KEY results in use of hard-coded crynvd · 2025-12-02
[NVD] CVE-2025-59705 (MEDIUM 6.8) — Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a Physically Proximate Attacker to Escalate Privileges by enabling the USB interface through chassis probe insertion during system boot, aka "Unautnvd · 2025-12-02
[NVD] CVE-2025-59702 (HIGH 7.2) — Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically proximate attacker with elevated privileges to falsify tamper events by accessing internal components.nvd · 2025-12-02
[NVD] CVE-2025-59701 (MEDIUM 4.1) — Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically proximate attacker (with elevated privileges) to read and modify the Appliance SSD contents (because they are unencrypted).nvd · 2025-12-02
[NVD] CVE-2025-59700 (LOW 3.9) — Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically proximate attacker with root access to modify the Recovery Partition (because of a lack of integrity protection).nvd · 2025-12-02
[NVD] CVE-2025-59699 (MEDIUM 6.8) — Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically proximate attacker to escalate privileges by booting from a USB device with a valid root filesystem. This occurs because of insecure dnvd · 2025-12-02
[NVD] CVE-2025-59697 (HIGH 7.2) — Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically proximate attacker to escalate privileges by editing the Legacy GRUB bootloader configuration to start a root shell upon boot of the hnvd · 2025-12-02
[NVD] CVE-2025-59695 (CRITICAL 9.8) — Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a user with OS root access to alter firmware on the Chassis Management Board (without Authentication). This is called F04.nvd · 2025-12-02
[NVD] CVE-2025-59694 (MEDIUM 6.8) — The Chassis Management Board in Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allows a physically proximate attacker to persistently modify firmware and influence the (insecurely configured) appliancnvd · 2025-12-02
[NVD] CVE-2025-59693 (CRITICAL 9.8) — The Chassis Management Board in Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allows a physically proximate attacker to obtain debug access and escalate privileges by bypassing the tamper label and onvd · 2025-12-02
[NVD] CVE-2025-13875 (MEDIUM 6.3) — A weakness has been identified in Yohann0617 oci-helper up to 3.2.4. This issue affects the function addCfg of the file src/main/java/com/yohann/ocihelper/service/impl/OciServiceImpl.java of the component OCI Configuration Upload. Executing manipulation of the argument File can lnvd · 2025-12-02
[NVD] CVE-2025-13879 (LOW 2.7) — Directory traversal vulnerability in SOLIDserver IPAM v8.2.3. This vulnerability allows an authenticated user with administrator privileges to list directories other than those to which the have authorized access using the 'directory' parameter in '/mod/ajax.php?action=sections/lnvd · 2025-12-02
[NVD] CVE-2025-13873 (MEDIUM 5.4) — Stored Cross-Site Scripting (XSS) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on web application allows an attacker to inject arbitrary JavaScript code, which executes in the browsing context of any visitor accessing the compromised survey.nvd · 2025-12-02
[NVD] CVE-2025-13872 (CRITICAL 9.1) — Blind Server-Side Request Forgery (SSRF) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on Web-based platforms allows an attacker to force the server to perform HTTP GET requests via crafted import requests to an arbitrary destination.nvd · 2025-12-02
[NVD] CVE-2025-13836 (HIGH 7.5) — When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.nvd · 2025-12-01
[NVD] CVE-2025-13829 — Incorrect Authorization vulnerability in Data Illusion Zumbrunn NGSurvey allows any logged-in user to obtain the private information of any other user. Critical information retrieved: * APIKEY (1 year user Session) * RefreshToken (10 minutes user Session) * Passwordnvd · 2025-12-01
[NVD] CVE-2025-13816 (MEDIUM 6.3) — A security vulnerability has been detected in moxi159753 Mogu Blog v2 up to 5.2. The impacted element is the function FileOperation.unzip of the file /networkDisk/unzipFile of the component ZIP File Handler. Such manipulation of the argument fileUrl leads to path traversal. The anvd · 2025-12-01
[NVD] CVE-2025-13815 (MEDIUM 6.3) — A weakness has been identified in moxi159753 Mogu Blog v2 up to 5.2. The affected element is an unknown function of the file /file/pictures. This manipulation of the argument filedatas causes unrestricted upload. The attack may be initiated remotely. The exploit has been made avanvd · 2025-12-01
[NVD] CVE-2025-13814 (HIGH 7.3) — A security flaw has been discovered in moxi159753 Mogu Blog v2 up to 5.2. Impacted is the function LocalFileServiceImpl.uploadPictureByUrl of the file /file/uploadPicsByUrl. The manipulation results in server-side request forgery. The attack can be launched remotely. The exploit nvd · 2025-12-01
[NVD] CVE-2025-13813 (MEDIUM 5.6) — A vulnerability was identified in moxi159753 Mogu Blog v2 up to 5.2. This issue affects some unknown processing of the file /storage/ of the component Storage Management Endpoint. The manipulation leads to missing authorization. The attack can be initiated remotely. The attack's nvd · 2025-12-01
[NVD] CVE-2025-13811 (MEDIUM 6.3) — A vulnerability was determined in jsnjfz WebStack-Guns 1.0. This vulnerability affects unknown code of the file src/main/java/com/jsnjfz/manage/core/common/constant/factory/PageFactory.java. Executing a manipulation of the argument sort can lead to sql injection. It is possible tnvd · 2025-12-01
[NVD] CVE-2025-13810 (MEDIUM 5.3) — A vulnerability was found in jsnjfz WebStack-Guns 1.0. This affects the function renderPicture of the file src/main/java/com/jsnjfz/manage/modular/system/controller/KaptchaController.java. Performing a manipulation results in path traversal. It is possible to initiate the attack nvd · 2025-12-01
[NVD] CVE-2025-13809 (MEDIUM 6.3) — A vulnerability has been found in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1. Affected by this issue is some unknown functionality of the file orion-ops-api/orion-ops-web/src/main/java/cn/orionsec/ops/controller/MachineInfoController.java of the component Snvd · 2025-12-01
[NVD] CVE-2025-13808 (HIGH 7.3) — A flaw has been found in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1. Affected by this vulnerability is the function update of the file orion-ops-api/orion-ops-web/src/main/java/cn/orionsec/ops/controller/UserController.java of the component User Profile Hannvd · 2025-12-01
[NVD] CVE-2025-13807 (MEDIUM 4.3) — A vulnerability was detected in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1. Affected is the function MachineKeyController of the file orion-ops-api/orion-ops-web/src/main/java/cn/orionsec/ops/controller/MachineKeyController.java of the component API. The manvd · 2025-12-01
[NVD] CVE-2025-13805 (LOW 3.7) — A weakness has been identified in nutzam NutzBoot up to 2.6.0-SNAPSHOT. This affects the function getInputStream of the file nutzcloud/nutzcloud-literpc/src/main/java/org/nutz/boot/starter/literpc/impl/endpoint/http/HttpServletRpcEndpoint.java of the component LiteRpc-Serializer.nvd · 2025-12-01
[NVD] CVE-2025-13804 (MEDIUM 4.3) — A security flaw has been discovered in nutzam NutzBoot up to 2.6.0-SNAPSHOT. The impacted element is an unknown function of the file nutzboot-demo/nutzboot-demo-simple/nutzboot-demo-simple-web3j/src/main/java/io/nutz/demo/simple/module/EthModule.java of the component Ethereum Walnvd · 2025-12-01
[NVD] CVE-2025-13803 (HIGH 7.3) — A vulnerability was identified in MediaCrush 1.0.0/1.0.1. The affected element is an unknown function of the file /mediacrush/paths.py of the component Header Handler. Such manipulation of the argument Host leads to improper neutralization of http headers for scripting syntax. Thnvd · 2025-12-01
[NVD] CVE-2025-13802 (MEDIUM 4.3) — A vulnerability was determined in jairiidriss RestaurantWebsite up to e7911f12d035e8e2f9a75e7a28b59e4ef5c1d654. Impacted is an unknown function of the component Make a Reservation. This manipulation of the argument selected_date causes cross site scripting. The attack can be initnvd · 2025-12-01
[NVD] CVE-2025-13800 (MEDIUM 6.3) — A vulnerability was found in ADSLR NBR1005GPEV2 250814-r037c. This issue affects the function set_mesh_disconnect of the file /send_order.cgi. The manipulation of the argument mac results in command injection. It is possible to launch the attack remotely. The exploit has been madnvd · 2025-12-01
[NVD] CVE-2025-13799 (MEDIUM 6.3) — A vulnerability has been found in ADSLR NBR1005GPEV2 250814-r037c. This vulnerability affects the function ap_macfilter_del of the file /send_order.cgi. The manipulation of the argument mac leads to command injection. It is possible to initiate the attack remotely. The exploit hanvd · 2025-12-01
[NVD] CVE-2025-13797 (MEDIUM 6.3) — A vulnerability was detected in ADSLR B-QE2W401 250814-r037c. Affected by this issue is the function parameterdel_swifimac of the file /send_order.cgi. Performing manipulation of the argument del_swifimac results in command injection. The attack is possible to be carried out remonvd · 2025-12-01
[NVD] CVE-2025-13796 (MEDIUM 6.3) — A security vulnerability has been detected in deco-cx apps up to 0.120.1. Affected by this vulnerability is the function AnalyticsScript of the file website/loaders/analyticsScript.ts of the component Parameter Handler. Such manipulation of the argument url leads to server-side rnvd · 2025-12-01
[NVD] CVE-2025-13795 (LOW 2.4) — A weakness has been identified in codingWithElias School Management System up to f1ac334bfd89ae9067cc14dea12ec6ff3f078c01. Affected is an unknown function of the file /student-view.php of the component Edit Student Info Page. This manipulation of the argument First Name causes crnvd · 2025-11-30
[NVD] CVE-2025-13793 (MEDIUM 4.3) — A weakness has been identified in winston-dsouza Ecommerce-Website up to 87734c043269baac0b4cfe9664784462138b1b2e. Affected by this issue is some unknown functionality of the file /includes/header_menu.php of the component GET Parameter Handler. Executing manipulation of the argunvd · 2025-11-30
[NVD] CVE-2025-13792 (HIGH 7.3) — A security flaw has been discovered in Qualitor up to 8.20.104/8.24.97. Affected by this vulnerability is the function eval of the file /html/st/stdeslocamento/request/getResumo.php. Performing a manipulation of the argument passageiros results in code injection. Remote exploitatnvd · 2025-11-30
[NVD] CVE-2025-13791 (MEDIUM 6.3) — A vulnerability was identified in Scada-LTS up to 2.7.8.1. Affected is the function Common.getHomeDir of the file br/org/scadabr/vo/exporter/ZIPProjectManager.java of the component Project Import. Such manipulation leads to path traversal. The attack may be launched remotely. Thenvd · 2025-11-30
[NVD] CVE-2025-13790 (MEDIUM 4.3) — A vulnerability was determined in Scada-LTS up to 2.7.8.1. This impacts an unknown function. This manipulation causes cross-site request forgery. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early abounvd · 2025-11-30
[NVD] CVE-2025-13789 (MEDIUM 6.3) — A vulnerability was found in ZenTao up to 21.7.6-8564. This affects the function makeRequest of the file module/ai/model.php. The manipulation of the argument Base results in server-side request forgery. The attack can be launched remotely. The exploit has been made public and convd · 2025-11-30
[NVD] CVE-2025-13788 (HIGH 7.3) — A vulnerability has been found in Chanjet CRM up to 20251106. The impacted element is an unknown function of the file /tools/upgradeattribute.php. The manipulation of the argument gblOrgID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosenvd · 2025-11-30
[NVD] CVE-2025-13787 (MEDIUM 5.4) — A flaw has been found in ZenTao up to 21.7.6-8564. The affected element is the function file::delete of the file module/file/control.php of the component File Handler. Executing manipulation of the argument fileID can lead to improper privilege management. It is possible to launcnvd · 2025-11-30
[NVD] CVE-2025-13786 (HIGH 7.3) — A vulnerability was detected in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. Impacted is the function fetch of the file /index.php. Performing manipulation of the argument content results in code injection. It is possible to initiate the attack remotely. The explonvd · 2025-11-30
[NVD] CVE-2025-13785 (MEDIUM 4.3) — A security vulnerability has been detected in yungifez Skuul School Management System up to 2.6.5. This issue affects some unknown processing of the file /user/profile of the component Image Handler. Such manipulation leads to information disclosure. The attack may be performed fnvd · 2025-11-30
[NVD] CVE-2025-13784 (LOW 2.4) — A weakness has been identified in yungifez Skuul School Management System up to 2.6.5. This vulnerability affects unknown code of the file /dashboard/schools/1/edit of the component SVG File Handler. This manipulation causes cross site scripting. The attack is possible to be carrnvd · 2025-11-30
[NVD] CVE-2025-6666 (LOW 2.0) — A vulnerability was determined in motogadget mo.lock Ignition Lock up to 20251125. Affected by this vulnerability is an unknown functionality of the component NFC Handler. Executing a manipulation can lead to use of hard-coded cryptographic key . The physical device can be targenvd · 2025-11-29
[NVD] CVE-2025-13762 — Improper Input Validation vulnerability in CyberArk CyberArk Secure Web Sessions Extension on Chrome, Edge allows Denial of Service when trying to starting new SWS sessions.This issue affects CyberArk Secure Web Sessions Extension: before 2.2.30305.nvd · 2025-11-27
[NVD] CVE-2025-62593 — Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-based attacks, as the cnvd · 2025-11-26
[NVD] CVE-2025-13601 (HIGH 7.7) — A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the lengthnvd · 2025-11-26
How GitHub’s agentic security principles make our AI agents as secure as possiblegithub_security_lab · 2025-11-25
Antigravity Grounded! Security Vulnerabilities in Google's Latest IDEembracethered · 2025-11-25
[Breach] Suno — 55,282,226 accounts exposedhibp_breaches · 2025-11-25
[NVD] CVE-2025-11003 (MEDIUM 6.4) — The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'uip_save_ui_template' function in all versions up to, and including, 3.5.09. This makes it posnvd · 2025-11-21
[NVD] CVE-2025-10938 (MEDIUM 6.5) — The UiPress lite plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.08. This is due to missing capability checks in the 'uip_process_block_query' AJAX function. This makes it possible for authenticated attackers, with sunvd · 2025-11-21
What organisations can learn from the record breaking fine over Capita’s ransomware incidentdoublepulsar · 2025-11-20
Android Quick Share Support for AirDrop: A Secure Approach to Cross-Platform File Sharinggoogle_security · 2025-11-20
[NVD] CVE-2025-61664 (MEDIUM 4.9) — A vulnerability in the GRUB2 bootloader has been identified in the normal module. This flaw, a memory Use After Free issue, occurs because the normal_exit command is not properly unregistered when its related module is unloaded. An attacker can exploit this condition by invoking nvd · 2025-11-18
[NVD] CVE-2025-61663 (MEDIUM 4.9) — A vulnerability has been identified in the GRUB2 bootloader's normal command that poses an immediate Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the normal command is not properly unregistered when the module is unloaded. An attacker who can nvd · 2025-11-18
[NVD] CVE-2025-61662 (HIGH 7.8) — A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the gettext command remains registered in memory after its module is unloaded. An attacker can exploit this condition by invoking the orphaned command, causnvd · 2025-11-18
[NVD] CVE-2025-61661 (MEDIUM 4.8) — A vulnerability has been identified in the GRUB (Grand Unified Bootloader) component. This flaw occurs because the bootloader mishandles string conversion when reading information from a USB device, allowing an attacker to exploit inconsistent length values. A local attacker can nvd · 2025-11-18
[NVD] CVE-2025-54771 (MEDIUM 4.9) — A use-after-free vulnerability has been identified in the GNU GRUB (Grand Unified Bootloader). The flaw occurs because the file-closing process incorrectly retains a memory pointer, leaving an invalid reference to a file system structure. An attacker could exploit this vulnerabilnvd · 2025-11-18
[NVD] CVE-2025-54770 (MEDIUM 4.9) — A vulnerability has been identified in the GRUB2 bootloader's network module that poses an immediate Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the net_set_vlan command is not properly unregistered when the network module is unloaded from menvd · 2025-11-18
[NVD] CVE-2025-63994 — Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2018-9206. Reason: This record is a duplicate of CVE-2018-9206. Notes: All CVE users should reference CVE-2018-9206 instead of this record. All references and descriptions in this record have been removed to prevent accnvd · 2025-11-18
How an Old Bug in Lighttpd Gained New Life in AMI BMC, Including Lenovo and Intel productsbinarly · 2025-11-18
YAMAGoya: A Real-time Client Monitoring Tool Using Sigma and YARA Rulesjpcert_blog · 2025-11-18
Rust in Android: move fast and fix thingsgoogle_security · 2025-11-13
[NVD] CVE-2025-40206 (HIGH 7.8) — In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_objref: validate objref and objrefmap expressions Referencing a synproxy stateful object from OUTPUT hook causes kernel crash due to infinite recursive calls: BUG: TASK stack guard page was hit nvd · 2025-11-12
[NVD] CVE-2025-40196 — In the Linux kernel, the following vulnerability has been resolved: fs: quota: create dedicated workqueue for quota_release_work There is a kernel panic due to WARN_ONCE when panic_on_warn is set. This issue occurs when writeback is triggered due to sync call for an opened filnvd · 2025-11-12
[NVD] CVE-2025-2843 (HIGH 8.8) — A flaw was found in the Observability Operator. The Operator creates a ServiceAccount with *ClusterRole* upon deployment of the *Namespace-Scoped* Custom Resource MonitorStack. This issue allows an adversarial Kubernetes Account with only namespaced-level roles, for example, a tenvd · 2025-11-12
[NVD] CVE-2025-40168 (HIGH 8.1) — In the Linux kernel, the following vulnerability has been resolved: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). smc_clc_prfx_match() is called from smc_listen_work() and not under RCU nor RTNL. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sknvd · 2025-11-12
[NVD] CVE-2025-40139 (HIGH 7.8) — In the Linux kernel, the following vulnerability has been resolved: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set(). smc_clc_prfx_set() is called during connect() and not under RCU nor RTNL. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sk_dst_genvd · 2025-11-12
[NVD] CVE-2025-40123 (HIGH 7.8) — In the Linux kernel, the following vulnerability has been resolved: bpf: Enforce expected_attach_type for tailcall compatibility Yinhao et al. recently reported: Our fuzzer tool discovered an uninitialized pointer issue in the bpf_prog_test_run_xdp() function within the Linvd · 2025-11-12
VTPRACTITIONERS{ACRONIS}: Tracking FileFix, Shadow Vector, and SideWindervirustotal_blog · 2025-11-10
[NVD] CVE-2025-10230 (CRITICAL 10.0) — A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration packets are passed to a shell without proper validation or escaping. Unsanitized NetBIOS name data from WINS registration packets are inserted into a shell command and executed by the nvd · 2025-11-07
Reversing at Scale: AI-Powered Malware Detection for Apple’s Binariesvirustotal_blog · 2025-11-06
[NVD] CVE-2023-43000 (HIGH 8.8) — A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption.nvd · 2025-11-05