10839 matches found
CVE-2025-65100 Security Snapshot May Use Unintended Timestamp When Only ISAR_APT_SNAPSHOT_DATE Is Set
Isar is an integration system for automated root filesystem generation. In versions 0.11-rc1 and 0.11, defining ISARAPTSNAPSHOTDATE alone does not set the correct timestamp value for security distribution, leading to missed security updates. This issue has been patched via commit 738bcbb...
Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to Allocation of Resources Without Limits or Throttling due to Bouncy Castle(CVE-2025-8916 & CVE-2025-8885)
Summary IBM App Connect Enterprise runtime and IBM Integration Bus for z/OS are vulnerable to Allocation of Resources Without Limits or Throttling due to Bouncy Castle. Vulnerability Details CVEID:CVE-2025-8916 DESCRIPTION: Allocation of Resources Without Limits or Throttling vulnerability in...
PT-2025-47518
Name of the Vulnerable Software and Affected Versions Isar versions 0.11-rc1 through 0.11 Description Isar is a system for automated root filesystem generation. In versions 0.11-rc1 and 0.11, defining the ISAR APT SNAPSHOT DATE variable alone does not correctly set the timestamp value for securit...
OPENSUSE-SU-2025:20048-1 Security update for samba
This update for samba fixes the following issues: Update to 4.22.5: CVE-2025-10230: Command injection via WINS server hook script bsc1251280. CVE-2025-9640: uninitialized memory disclosure via vfsstreamsxattr bsc1251279. - Relax samba-gpupdate requirement for cepces, certmonger, and sscep to a...
ai.catboost:catboost-spark_4.0_2.13 (=1.2.10), cloud.piranha.extension:piranha-extension-microprofile (>=21.1.0 <=21.5.0) +580 more potentially affected by CVE-2025-12383 via org.glassfish.jersey.core:jersey-client (>=3.0.0-M1 <=3.0.16)
org.glassfish.jersey.core:jersey-client MAVEN version =3.0.0-M1, =21.1.0, =2.0.14-spark-4.0, =3.149.2-beta, =3.149.2-beta, =3.149.2-beta, =3.149.2-beta, =3.149.2-beta, =3.149.2-beta, =4.43.0, =2.0.0, =2.0.0, =2.0.2 and more Source cves: CVE-2025-12383 Source advisory:...
Agents built into your workflow: Get Security Copilot with Microsoft 365 E5
The cybersecurity landscape is at a historic inflection point. As cyberattackers wield AI to automate cyberattacks at extraordinary speed and scale, the challenge before us is not just to keep pace—but to leap ahead. There are over four million unfilled cybersecurity jobs, so depending solely on...
Security Bulletin: IBM Integration Bus for z/OS is vulnerable to multiple vulnerabilities due to Apache Tomcat( CVE-2025-55752,CVE-2025-55754 & CVE-2025-61795)
Summary IBM Integration Bus for z/OS is vulnerable to multiple vulnerabilities due to Apache Tomcat. Vulnerability Details CVEID:CVE-2025-55752 DESCRIPTION: Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized...
cve-exploit-chain-analyzer
🔐 CVE Exploit Chain Analyzer Automated vulnerability scanner...
CVE-2025-63695
DzzOffice v2.3.7 and before is vulnerable to Arbitrary File Upload in /dzz/system/ueditor/php/controller.php...
What It Takes to Design Trust into Event-Driven Architectures with Amazon EventBridge
How disciplined design turns Amazon EventBridge from an open event bus into a system of verified trust. Event-driven architecture has become essential for achieving agility in the cloud. Yet as integrations multiply, so do the hidden pathways that adversaries can exploit. Amazon EventBridge helps...
kernel: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush In KVM guests with Hyper-V hypercalls enabled, the hypercalls HVCALLFLUSHVIRTUALADDRESSLIST and HVCALLFLUSHVIRTUALADDRESSLISTEX allow a guest to request...
It's a Feature, Not a Bug: Secure and Auditable State Rollback for Confidential Cloud Applications
Replay and rollback attacks threaten cloud application integrity by reintroducing authentic yet stale data through an untrusted storage interface to compromise application decision-making. Prior security frameworks mitigate these attacks by enforcing forward-only state transitions state continuit...
Your passport, now on your iPhone. Helpful or risky?
Apple has launched Digital ID, a way for users in the US to create and present a government-issued ID in Apple Wallet using their passport information. For now, it works only for identity verification at Transportation Security Administration TSA checkpoints in more than 250 airports. Apple says...
CVE-2025-55073 MS Teams plugin OAuth allows editing arbitrary posts
Mattermost versions 10.11.x = 10.11.3, 10.5.x = 10.5.11, 10.12.x = 10.12.0 fail to validate the relationship between the post being updated and the MSTeams plugin OAuth flow which allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL...
Finding Software Supply Chain Attack Paths with Logical Attack Graphs
Cyberattacks are becoming increasingly frequent and sophisticated, often exploiting the software supply chain SSC as an attack vector. Attack graphs provide a detailed representation of the sequence of events and vulnerabilities that could lead to a successful security breach in a system. MulVal ...
CKEditor <= 46.1.0 Reflected XSS Vulnerability
CKEditor 5 is prone to a reflected cross-site scripting XSS vulnerability when used with Angular. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-on...
BreachLock and Vanta Bridge the Gap Between Continuous Security Testing and Compliance with New Integration
New York, New York, 13th November 2025, CyberNewsWire...
EUVD-2025-175598
Malicious code in webdriverio-jasmine-dione-perseus npm...