Qualcomm Heap Buffer Overflow Information Disclosure

The vulnerability of embedded Qualcomm software lies in the reading of data beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to disclose protected information during the processing of the MBN file hash segment...

CVE-2020-36986

Prey 1.9.6 contains an unquoted service path vulnerability that allows local users to potentially execute code with elevated privileges. Attackers can exploit the unquoted path in the CronService to insert malicious code that would execute during application startup or system reboot...

CVE-2020-36987

Program Access Controller 1.2.0.0 contains an unquoted service path vulnerability in PACService.exe that allows local attackers to execute code with elevated privileges. Attackers can exploit the unquoted path during system startup or reboot to inject and run malicious executables with LocalSyste...

osbuild-composer security update

101.4-2.0.1 - Support using repository definitons with OCI variables JIRA: OLDIS-38657 - Update repositories to contain OCI variables - Remove image types Minimal-raw and wsl JIRA: OLDIS-38123 - Increase default /boot size to 1GB Orabug: 36827079 - support for building OL8/9 images on Oracle Linu...

CVE-2026-1549: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was identified in jishenghua jshERP up to 3.6. Affected by this vulnerability is an unknown functionality of the file /jshERP-boot/plugin/uploadPluginConfigFile of the component PluginController. Such manipulation of the argument configFile leads to path traversal. The attack may ...

EUVD-2020-30868

Quick 'n Easy FTP Service 3.2 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code during service startup. Attackers can exploit the misconfigured service binary path to inject malicious executables with elevated LocalSystem privileges during syste...

This Week in Spring - January 27th, 2026

Hi, Spring fans! Welcome to another installment of This Week in Spring! As I write this, I cannot believe we're nearly at the end of the month! Time sure flies. Spring AI 2.0.0-M2 is available now Spring Modulith 2.1 M1, 2.0.2, and 1.4.7 released In last week's installment of A Bootiful Podcast ,...

Security Bulletin: This Power System update is being released to address CVE-2025-52497

Summary When Linux Secure Boot is enabled, a malformed public key certificate in the grubdb or grubdbx can cause a DoS blocking Linux partition boot or make a limited amount of partition memory available. Vulnerability Details CVEID:CVE-2025-52497 DESCRIPTION: Mbed TLS before 3.6.4 has a PEM...

Security Bulletin: This Power System update is being released to address CVE-2025-49087

Summary Mbed-TLS is used by partition firmware for Linux secure boot. This update is being released to mitigate any potential impacts to Linux partitions with secure boot enabled. Vulnerability Details CVEID:CVE-2025-49087 DESCRIPTION: In Mbed TLS 3.6.1 through 3.6.3 before 3.6.4, a timing...

io.github.anaconda875:reactive-hibernate-spring-boot-starter (1.1.3), io.quarkus:quarkus-hibernate-reactive (>=3.11.0.cr1, <=3.11.0) +12 more potentially affected by CVE-2025-14969 via org.hibernate.reactive:hibernate-reactive-core (2.3.0.final)

org.hibernate.reactive:hibernate-reactive-core MAVEN version 2.3.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate.reactive:hibernate-reactive-core and may be impacted: - io.github.anaconda875:reactive-hibernate-spring-boot-starter...

This Week in Spring - January 26th, 2026

Hi, Spring fans! Welcome to another installment of This Week in Spring! As I write this, I cannot believe we're nearly at the end of the month! Time sure flies. Spring AI 2.0.0-M2 is available now Spring Modulith 2.1 M1, 2.0.2, and 1.4.7 released In last week's installment of A Bootiful Podcast ,...

January 24, 2026—KB5078129 (OS Builds 19045.6812 and 19044.6812) Out-of-band

January 24, 2026—KB5078129 OS Builds 19045.6812 and 19044.6812 Out-of-band Applies To Windows 10 ESU Windows 10 Enterprise LTSC 2021 Windows Secure Boot certificate expiration Important: Secure Boot certificates used by most Windows devices have started expiring in June 2026. This might affect th...

January 24, 2026—KB5078131 (OS Build 17763.8281) Out-of-band

January 24, 2026—KB5078131 OS Build 17763.8281 Out-of-band Applies To Win 10 Ent LTSC 2019 Windows Server 2019 Windows Secure Boot certificate expiration Important: Secure Boot certificates used by most Windows devices have started expiring in June 2026. This might affect the ability of certain...

xss-protector

Lucy XSS Filter for Spring Boot 네이버 Lucy XSS Filter를 사용한 강력...

com.almis.awe:awe-annotation (>=4.10.11, <=4.11.2), com.almis.awe:awe-annotations-spring-boot-starter (>=4.10.11, <=4.11.2) +152 more potentially affected by CVE-2025-22234 via org.springframework.security:spring-security-crypto (6.3.8)

org.springframework.security:spring-security-crypto MAVEN version 6.3.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - com.almis.awe:awe-annotation =4.10.11, =4.10.11, =4.10.11...

Exploit for Out-of-bounds Read in Libpng

Spring Boot Minimal Images PoC Dummy Spring Boot application...

Azure Linux 3.0 Security Update: kernel (CVE-2024-46706)

"The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-46706 advisory. - In the Linux kernel, the following vulnerability has been resolved: tty: serial: fsllpuart: mark last busy...

Azure Linux 3.0 Security Update: kernel (CVE-2025-22009)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-22009 advisory. - In the Linux kernel, the following vulnerability has been resolved: regulator: dummy: force synchronous...

Azure Linux 3.0 Security Update: kernel (CVE-2024-36925)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-36925 advisory. - In the Linux kernel, the following vulnerability has been resolved: swiotlb: initialise restricted pool...

Azure Linux 3.0 Security Update: kernel (CVE-2025-38354)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-38354 advisory. - In the Linux kernel, the following vulnerability has been resolved: drm/msm/gpu: Fix crash when throttling G...