CVE-2021-46750

CVE-2021-46750 describes a failure to validate address and size in a Trusted Execution Environment (TEE) that could allow a local x86 attacker to send malformed messages to the graphics mailbox, causing overlap of a previously allocated Trusted Memory Region (TMR) by the ASP bootloader and potent...

CVE-2021-46750

Failure to validate the address and size in TEE Trusted Execution Environment may allow a malicious x86 attacker to send malformed messages to the graphics mailbox resulting in an overlap of a TMR Trusted Memory Region that was previously allocated by the ASP bootloader leading to a potential los...

Malicious npm Packages Impersonate Flashbots, Steal Ethereum Wallet Keys

A new set of four malicious packages have been discovered in the npm package registry with capabilities to steal cryptocurrency wallet credentials from Ethereum developers. "The packages masquerade as legitimate cryptographic utilities and Flashbots MEV infrastructure while secretly exfiltrating...

PT-2025-36396

Name of the Vulnerable Software and Affected Versions: TEE SOC Driver affected versions not specified Description: Insufficient parameter sanitization in the TEE SOC Driver could allow an attacker to issue a malformed DRV SOC CMD ID SRIOV SPATIAL PART command, potentially leading to read or write...

PT-2025-36375

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. affected versions not specified Description: A failure to validate the address and size within the Trusted Execution Environment TEE could allow a malicious x86 attacker to send malformed messages to the...

PT-2025-36380

Name of the Vulnerable Software and Affected Versions: ASP affected versions not specified Description: The use of an uninitialized variable in the ASP could allow an attacker to access leftover data from a trusted execution environment TEE driver, potentially leading to loss of confidentiality...

CVE-2021-26383

Insufficient bounds checking in AMD TEE Trusted Execution Environment could allow an attacker with a compromised userspace to invoke a command with malformed arguments leading to out of bounds memory access, potentially resulting in loss of integrity or availability...

CVE-2025-58373 Roo Code: Symlink-bypass of .rooignore can lead to unintended file disclosure

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a vulnerability where .rooignore protections could be bypassed using symlinks. This allows an attacker with write access to the workspace to trick the extension into reading files th...

MAL-2025-46876 Malicious code in zephyr-electron-builder-cross-env-cressida (npm)

The package zephyr-electron-builder-cross-env-cressida was found to contain malicious code...

CVE-2025-47907 affecting package golang for versions less than 1.23.12-1

CVE-2025-47907 affecting package golang for versions less than 1.23.12-1. An upgraded version of the package is available that resolves this issue...

PT-2025-36342

Name of the Vulnerable Software and Affected Versions: AMD TEE affected versions not specified Description: Insufficient bounds checking in AMD TEE Trusted Execution Environment could allow an attacker with a compromised userspace to invoke a command with malformed arguments, leading to...

Linux Distros Unpatched Vulnerability : CVE-2025-24959

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - zx is a tool for writing better scripts. An attacker with control over environment variable values can inject unintended environment variables into process.env...

Security Bulletin: IBM Stering B2B Integrator and IBM Sterling File Gateway are Vulnerable to Denial of Service Due to IBM WebSphere Application Server Liberty (CVE-2024-47535)

Summary IBM Stering B2B Integrator and IBM Sterling File Gateway have addressed the denial of service vulnerability Vulnerability Details CVEID:CVE-2024-47535 DESCRIPTION: Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance...

Moderate: Red Hat Security Advisory: Red Hat build of Keycloak 26.0.15 Images Update

New images are available for Red Hat build of Keycloak 26.0.15 and Red Hat build of Keycloak 26.0.15 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Ha...

org.keycloak/keycloak-model-storage-service: Variable injection into environment variables

A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource substitutes placeholders within imported realm documents, potentially referencing environment variables. This substitution process allows for injection attacks when crafted realm documents are...

org.keycloak/keycloak-model-storage-service: Variable injection into environment variables

A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource substitutes placeholders within imported realm documents, potentially referencing environment variables. This substitution process allows for injection attacks when crafted realm documents are...

Unsanitized NUL in environment variables on Windows in syscall and os/exec

...

Exploit for SQL Injection in Sangoma Freepbx

Work in Progress FreePBX CVE-2025-57819 Lab - Unauth SQLi →...

Output of "go env" does not sanitize values in cmd/go

...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that can be exploited by an attacker to cause arbitrary Java code to be loaded in a privileged environment...