GHSA-XRV8-2PF5-F3Q7 nitro-tpm-pcr-compute may allow kernel command line modification by an account operator

Summary Adding default PCR12 validation to ensure that account operators can not modify kernel command line parameters, potentially bypassing root filesystem integrity validation. Attestable AMIs are based on the systemd Unified Kernel Image UKI concept which uses systemd-boot to create a single...

CVE-2025-62575 Mirion Medical EC2 Software NMIS BioDose Incorrect Permission Assignment for Critical Resource

NMIS/BioDose V22.02 and previous versions rely on a Microsoft SQL Server database. The SQL user account 'nmdbuser' and other created accounts by default have the sysadmin role. This can lead to remote code execution through the use of certain built-in stored procedures...

CVE-2025-62593

Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-based attacks, as the current defense us...

CVE-2025-62593

Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-based attacks, as the current defense us...

CVE-2025-65073

OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone authorization...

PT-2025-48198

Name of the Vulnerable Software and Affected Versions Ray versions prior to 2.52.0 Description Ray, an AI compute engine, is affected by a critical Remote Code Execution RCE issue. The problem stems from insufficient protection against browser-based attacks. The current defense relies on the...

Virtuozzo Hybrid Infrastructure 7.0 Hotfix 5 (7.0.0-273)

This update provides important stability fixes. Vulnerability id: VSTOR-115013 A stability fix for libvirt. Vulnerability id: VSTOR-115455 Failed to add a node to the compute cluster. Vulnerability id: VSTOR-118628 Fixed missing FUA write processing on dm-qcow2 and dm-ploop devices...

Google Launches 'Private AI Compute' — Secure AI Processing with On-Device-Level Privacy

Google on Tuesday unveiled a new privacy-enhancing technology called Private AI Compute to process artificial intelligence AI queries in a secure platform in the cloud. The company said it has built Private AI Compute to "unlock the full speed and power of Gemini cloud models for AI experiences,...

PT-2025-51643

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel’s DRM/amdgpu subsystem that can lead to a GPU page fault after hibernation on PF passthrough environments. Specifically, after resuming from hibernation...

CVE-2025-27070 Out-of-bounds Write in Windows Compute

Memory corruption while performing encryption and decryption commands...

CVE-2025-27070 Out-of-bounds Write in Windows Compute

Memory corruption while performing encryption and decryption commands...

CVE-2025-27070

CVE-2025-27070 is listed under Qualcomm closed-source components as a High-severity issue involving memory corruption during encryption and decryption commands. The available documents identify the vulnerability and its association with Qualcomm closed-source components, but do not provide a spec...

PT-2025-44922

Name of the Vulnerable Software and Affected Versions Windows Compute affected versions not specified Description A memory corruption issue exists when performing encryption and decryption commands. This can lead to an out-of-bounds write condition. Recommendations At the moment, there is no...

Jailbreaking in the Haystack

Recent advances in long-context language models LMs have enabled million-token inputs, expanding their capabilities across complex tasks like computer-use agents. Yet, the safety implications of these extended contexts remain unclear. To bridge this gap, we introduce NINJA short for...

CVE-2025-59503

Server-side request forgery ssrf in Azure Compute Gallery allows an unauthorized attacker to elevate privileges over a network...

EUVD-2025-35744

Server-side request forgery ssrf in Azure Compute Gallery allows an authorized attacker to elevate privileges over a network...

CVE-2025-59503

Server-side request forgery ssrf in Azure Compute Gallery allows an unauthorized attacker to elevate privileges over a network...

CVE-2025-59503 Azure Compute Resource Provider Elevation of Privilege Vulnerability

...

CVE-2025-59503

CVE-2025-59503 affects Azure Compute Gallery (Azure Compute Resource Provider). Root cause is SSRF that allows an unauthorized attacker to elevate privileges over the network. Documented impact is privilege escalation with high confidentiality/integrity/availability consequences. Remediation refe...

CVE-2025-59503 Azure Compute Resource Provider Elevation of Privilege Vulnerability

...