USN-7887-1: Linux kernel (Raspberry Pi Real-time) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - PowerPC architecture; - x86 architecture; - ACPI drivers; - Ublk userspace block driver; -...

USN-7887-1 linux-raspi-realtime vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - PowerPC architecture; - x86 architecture; - ACPI drivers; - Ublk userspace block driver; -...

New Fluent Bit Flaws Expose Cloud to RCE and Stealthy Infrastructure Intrusions

Cybersecurity researchers have discovered five vulnerabilities in Fluent Bit, an open-source and lightweight telemetry agent, that could be chained to compromise and take over cloud infrastructures. The security defects "allow attackers to bypass authentication, perform path traversal, achieve...

The vulnerability of the gmc_v10_0_hw_fini() function in the drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c driver module allows a hacker to cause a service failure in AMD GPU-based Linux operating system Direct Rendering Infrastructure (DRI).

The vulnerability of the gmcv100hwfini function in the drivers/gpu/drm/amd/amdgpu/gmcv100.c driver module relates to the lack of memory release after the effective lifespan of the function. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the `create_validate_stream_for_sink()` function in the drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c file of the DRI support driver for AMD GPU-based Linux operating system kernels allows a malicious actor to cause a service failure.

The vulnerability of the createvalidatestreamforsink function in the drivers/gpu/drm/amd/display/amdgpudm/amdgpudm.c file of the Direct Rendering Infrastructure DRI support driver for AMD graphics cards in Linux operating systems is related to pointer manipulation. Exploiting this vulnerability...

Security Bulletin: Terraform state versions can be created by users with specific permissions without sufficient write access

Summary Terraform state versions can be created by a user with specific but insufficient permissions in a Terraform Enterprise workspace. This may allow for the alteration of infrastructure if a subsequent plan operation is approved by a user with approval permission or is auto-applied. This...

USN-7879-2 linux-realtime-6.14 vulnerabilities

It was discovered that improper initialization of CPU cache memory could allow a local attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity. CVE-2024-36331 Several security issues were discovered in the Linux kernel. An attacker could possibly use...

CVE-2025-13432

Terraform state versions can be created by a user with specific but insufficient permissions in a Terraform Enterprise workspace. This may allow for the alteration of infrastructure if a subsequent plan operation is approved by a user with approval permission or auto-applied. This vulnerability,...

CVE-2025-13432 Terraform Enterprise state versions can be created by users with specific permissions without sufficient write access

Terraform state versions can be created by a user with specific but insufficient permissions in a Terraform Enterprise workspace. This may allow for the alteration of infrastructure if a subsequent plan operation is approved by a user with approval permission or auto-applied. This vulnerability,...

CVE-2025-13432 Terraform Enterprise state versions can be created by users with specific permissions without sufficient write access

Terraform state versions can be created by a user with specific but insufficient permissions in a Terraform Enterprise workspace. This may allow for the alteration of infrastructure if a subsequent plan operation is approved by a user with approval permission or auto-applied. This vulnerability,...

CVE-2025-13432

CVE-2025-13432 affects Terraform Enterprise: state versions can be created by a user with insufficient permissions in a workspace, potentially allowing infrastructure alterations after a plan is approved or auto-applied. Affected versions (per connected sources) include Terraform Enterprise 1.1.0...

CVE-2025-13432: Incorrect Authorization

Terraform state versions can be created by a user with specific but insufficient permissions in a Terraform Enterprise workspace. This may allow for the alteration of infrastructure if a subsequent plan operation is approved by a user with approval permission or auto-applied. This vulnerability,...

The vulnerability of the Docker Wizard tool for monitoring IT infrastructure Nagios XI allows a attacker to execute arbitrary commands.

The vulnerability of the Docker Wizard tool for monitoring IT infrastructure Nagios XI relates to the failure to take measures to neutralize certain elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

PT-2025-47784

Name of the Vulnerable Software and Affected Versions Terraform Enterprise versions prior to 1.0.3 and prior to 1.1.1 Description A user with limited permissions within a Terraform Enterprise workspace can create Terraform state versions. This could lead to infrastructure changes if a subsequent...

HashiCorp Terraform Enterprise 安全漏洞

HashiCorp Terraform Enterprise is a development tool from HashiCorp USA. A security vulnerability exists in HashiCorp Terraform Enterprise that stems from insufficient privileges and could result in infrastructure changes...

CISA: Suspicious Unmanned Aircraft System Activity Guidance

Suspicious Unmanned Aircraft System Activity Guidance for Critical Infrastructure Owners and Operators is intended for critical infrastructure stakeholders who are concerned with unmanned aircraft system UAS activity near or around their facilities...

The vulnerability of the Core Command Expansion module in the Nagios XI IT infrastructure monitoring tool allows a hacker to execute arbitrary code.

The vulnerability of the Core Command Expansion module in the Nagios XI IT infrastructure monitoring tool is related to the lack of security measures taken to protect the website structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The State of Security Today: Setting the Stage for 2026

As we close out 2025, one thing is clear: the security landscape is evolving faster than most organizations can keep up. From surging ransomware campaigns and AI-enhanced phishing to data extortion, geopolitical fallout, and gaps in cyber readiness, the challenges facing security teams today are ...

Desktop Alert PingAlert Server-Side Request Forgery Vulnerability

Desktop Alert PingAlert is a network status monitoring tool developed by Desktop Alert, Inc. and is mainly used to monitor the status of network devices in real time and send alerts. Desktop Alert PingAlert suffers from a server-side request forgery vulnerability, which stems from the server not...

The vulnerability of the Business Process Intelligence (BPI) module of the Nagios XI IT infrastructure monitoring tool allows a attacker to execute arbitrary code.

The vulnerability of the Business Process Intelligence BPI module of the Nagios XI IT infrastructure monitoring tool is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...