TikTok: Major investigation launched into platform’s use of children’s data

TikTok is the subject of yet another major investigation, reports BBC News. This time around, the UK’s Information Commissioner's Office ICO is going to look at how the data of 13 to 17-year-olds feeds the algorithm that decides what further content to show. The ICO introduced a children’s code f...

The vulnerability of Acronis Cyber Protect 16’s data protection software lies in its uncontrolled search path, which allows attackers to exploit their privileges.

The vulnerability of Acronis Cyber Protect 16 data protection software is related to an uncontrolled element in the search process. Exploiting this vulnerability can allow attackers to enhance their privileges...

The vulnerability of the `avformat_free_context()` function in the libavformat multimedia library of FFmpeg allows attackers to compromise the integrity of protected information.

The vulnerability of the avformatfreecontext function in the library for multiplexing and demultiplexing media containers in the libavformat multimedia library of FFmpeg is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to compromise the integrity of the...

The vulnerability of the software for data integration and analysis in Hitachi Vantara Pentaho Data Integration & Analytics lies in the insufficient protection of registration data, which allows attackers to disclose confidential information.

The vulnerability of the software for data integration and analytics in Hitachi Vantara Pentaho Data Integration & Analytics relates to insufficient protection of registration data. Exploiting this vulnerability could allow a malicious actor to disclose confidential information...

The vulnerability of the libavutil library, a multimedia library used in FFmpeg, allows attackers to disclose protected information.

The vulnerability of the libavutil library, a multimedia library used in FFmpeg, is related to insufficient protection of sensitive data. Exploiting this vulnerability can allow an attacker to disclose protected information remotely...

Countries and companies are fighting at the expense of our data privacy

Data privacy issues are a hot topic in a world where we apparently don’t know who to trust anymore. A few weeks ago, we reported how the UK had secretly ordered Apple to provide blanket access to protected cloud backups around the world. This week, Apple decided to pull the plug on Advanced Data...

89% of Enterprise GenAI Usage Is Invisible to Organizations Exposing Critical Security Risks, New Report Reveals

Organizations are either already adopting GenAI solutions, evaluating strategies for integrating these tools into their business plans, or both. To drive informed decision-making and effective planning, the availability of hard data is essential—yet such data remains surprisingly scarce. The...

DRUPAL-CONTRIB-2025-018

The GDPR Task submodule enables you to create GDPR tasks. The module doesn't sufficiently protect against Cross Site Request Forgery CSRF attacks by validating user identity and intent when creating tasks...

UK Demanded Apple Add a Backdoor to iCloud

Last month, the UK government demanded that Apple weaken the security of iCloud for users worldwide. On Friday, Apple took steps to comply for users in the United Kingdom. But the British law is written in a way that requires Apple to give its government access to anyone, anywhere in the world. I...

CVE-2022-49054

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Deactivate sysctlrecordpanicmsg by default in isolated guests hvpanicpage might contain guest-sensitive information, do not dump it over to Hyper-V by default in isolated guests. While at it, update some...

Drupal General Data Protection Regulation module < 3.0.1,3.1.0-3.1.1 - Unauthenticated Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF vulnerability discovered by Pierre Rudloff prudloff in WordPress Module General Data Protection Regulation versions 3.0.1,3.1.0-3.1.1...

The vulnerability of the software products of the LLC “NPO ‘MIR’, related to the use of weak protection for database data, allows attackers to disclose the protected information.

The vulnerability of the software products developed by LLC “NPO ‘MIR’ lies in the use of weak protection for database credentials. Exploiting this vulnerability could allow an attacker, operating remotely, to disclose the protected information...

The vulnerability of Zoom’s video conferencing software lies in the insufficient protection of sensitive data, allowing attackers to gain unauthorized access to protected information.

The vulnerability of Zoom video conferencing software is related to insufficient protection of sensitive data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

The vulnerability of Zoom’s video conferencing software lies in the insufficient protection of sensitive data, allowing attackers to gain unauthorized access to protected information.

The vulnerability of Zoom video conferencing software is related to insufficient protection of sensitive data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the software for data integration and analytics in Hitachi Vantara Pentaho Data Integration & Analytics lies in the insufficient protection of registration data, allowing unauthorized access to protected information by attackers.

The vulnerability of the software for data integration and analytics in Hitachi Vantara Pentaho Data Integration & Analytics lies in the insufficient protection of registration data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to...

Command Platform Innovations Eliminate Data Blind Spots Through Complete Visibility and Context-Driven Risk Prioritization

Rapid7 provides unmatched attack surface visibility through the Command Platform, helping security teams identify, prioritize, and remediate risk across hybrid environments. Surface Command is the only solution available that combines native external and internal scanning into a single unified vi...

⚡ THN Weekly Recap: From $1.5B Crypto Heist to AI Misuse & Apple's Data Dilemma

Welcome to your weekly roundup of cyber news, where every headline gives you a peek into the world of online battles. This week, we look at a huge crypto theft, reveal some sneaky AI scam tricks, and discuss big changes in data protection. Let these stories spark your interest and help you...

The vulnerability of the runas function in the microprogramming software of the digital analysis system MEAC300 allows a hacker to elevate their privileges to the level of an administrator.

The vulnerability of the runas function in the MEAC300 digital analysis system is related to insufficient protection for registration data. Exploiting this vulnerability can allow an attacker, operating remotely, to elevate their privileges to the level of an administrator...

Apple Drops iCloud's Advanced Data Protection in the U.K. Amid Encryption Backdoor Demands

Apple is removing its Advanced Data Protection ADP feature for iCloud from the United Kingdom with immediate effect following government demands for backdoor access to encrypted user data. The development was first reported by Bloomberg. ADP for iCloud is an optional setting that ensures that...

Streamline Security: Automate Database Compliance with Qualys Cloud Agent

Compliance audit failures remain a critical challenge for organizations, particularly in database security. According to the 2024 Thales Data Threat Report, nearly 43% of companies failed at least one compliance audit in the past year. This is a significant concern because audit failures correlat...