How cyberattacks on companies affect everyone

If you use the internet, you’ve likely been affected by cybercrime in some way. Even when an attack is aimed at a company, the fallout usually lands on ordinary people. The most obvious harm is stolen data. When attackers break into a business, it is usually customer information that ends up in...

The vulnerability of the fsl_qspi_probe() function in the drivers/spi/spi-fsl-qspi.c file of the Linux kernel’s SPI device driver allows a hacker to cause a service failure.

The vulnerability of the fslqspiprobe function in the drivers/spi/spi-fsl-qspi.c file of the Linux kernel’s SPI device driver is related to the improper disabling or release of resources. Exploiting this vulnerability could allow an attacker to cause a service failure...

Oracle WebLogic Server Unauthorized Access (April 2026 CPU)

The 12.2.1.4.0 version of WebLogic Server installed on the remote host is affected by a vulnerability as referenced in the April 2026 CPU advisory. - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Centralized Thirdparty Jars Validator. The supported...

CVE-2026-31475

A flaw was found in the Linux kernel's ASoC sma1307 component. An incorrect cleanup operation attempts to manually free memory that is already managed by the device resource management devres system. This can lead to a double free vulnerability, potentially causing memory corruption and system...

CVE-2026-35348

The sort utility in uutils coreutils is vulnerable to a process panic when using the --files0-from option with inputs containing non-UTF-8 filenames. The implementation enforces UTF-8 encoding and utilizes expect, causing an immediate crash when encountering valid but non-UTF-8 paths. This diverg...

Allocation of Resources Without Limits or Throttling

Overview github.com/free5gc/pcf/internal/sbi/processor is a None Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling. via repeated HTTP requests to the OAM endpoint, which trigger the router.Use process. An attacker can exhaust system memory an...

CVE-2026-33611

An operator allowed to use the REST API can cause the Authoritative server to produce invalid HTTPS or SVCB record data, which can in turn cause LMDB database corruption, if using the LMDB backend...

CVE-2026-6775

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the WebRTC component...

The vulnerability of the Undici Node.js software platform’s HTTP client involves a lack of memory release after the effective lifespan, allowing attackers to trigger a service failure.

The vulnerability of the Undici software platform’s HTTP client involves a lack of memory release after the effective lifespan of the component. Exploiting this vulnerability can allow an attacker to cause service interruptions remotely...

EUVD-2026-24385

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite component: Personalization. Supported versions that are affected are 12.2.9-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Application...

CVE-2026-40924

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the HTTP resolver's FetchHttpResource function calls io.ReadAllresp.Body with no response body size limit. Any tenant...

CVE-2026-35250

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.6. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle V...

CVE-2026-29643

XiangShan Open-source high-performance RISC-V processor commit edb1dfaf7d290ae99724594507dc46c2c2125384 2024-11-28 contains an improper exceptional-condition handling flaw in its CSR subsystem NewCSR. On affected versions, certain sequences of CSR operations targeting non-existent/custom CSR...

CVE-2026-29647

In OpenXiangShan NEMU, insufficient Smstateen permission enforcement allows lower-privileged code to access IMSIC state via stopei/vstopei CSRs even when mstateen0.IMSIC is cleared, potentially enabling cross-context information leakage or disruption of interrupt handling...

The vulnerability of the Gimp image processing library, related to incorrect calculations of the buffer size allocated, allows a hacker to cause a service failure.

The vulnerability of the Gimp image processing library is related to incorrect calculations of the buffer size allocated for processing images. Exploiting this vulnerability can allow attackers to cause service failures...

The vulnerabilities of the Microsoft .NET software platform, Microsoft .NET Framework, and the Visual Studio source code editor allow attackers to induce a service failure.

The vulnerability of the Microsoft .NET software platform, Microsoft .NET Framework, and the source code editor Visual Studio is related to the execution of a loop with an unavailable exit condition. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

Oracle MySQL Server 安全漏洞

Oracle MySQL Server is a relational database management system developed by Oracle Corporation. There is a security vulnerability in Oracle MySQL Server, which stems from issues with the Server: Group Replication Plugin component. This vulnerability may allow attackers with low privileges to acce...

PT-2026-34000

Name of the Vulnerable Software and Affected Versions NVIDIA CUDA-Q affected versions not specified Description An unauthenticated attacker could cause an out-of-bounds read by sending a maliciously crafted request to an endpoint. This issue may lead to denial of service and information disclosur...

Unity Linux 20.1050e / 20.1070e Security Update: kernel (UTSA-2026-011095)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011095 advisory. In the Linux kernel, the following vulnerability has been resolved: igb: Fix igbdown hung on surprise removal In a setup where a Thunderbolt hub connects to Ethernet...

EUVD-2026-23960

In OpenXiangShan NEMU, insufficient Smstateen permission enforcement allows lower-privileged code to access IMSIC state via stopei/vstopei CSRs even when mstateen0.IMSIC is cleared, potentially enabling cross-context information leakage or disruption of interrupt handling...