Deserialization of Untrusted Data

Overview org.apache.kafka:kafka-clients is a streaming platform that can publish and subscribe to streams of records, store streams of records in a fault-tolerant durable way, and process streams of records as they occur. Affected versions of this package are vulnerable to Deserialization of...

DHCP Server Service Denial of Service Vulnerability

Protection mechanism failure in Windows DHCP Server allows an unauthorized attacker to deny service over a network...

DHCP Server Service Denial of Service Vulnerability

Protection mechanism failure in Windows DHCP Server allows an unauthorized attacker to deny service over a network...

PT-2025-24838 · Microsoft · Windows Rdp Server +1

Name of the Vulnerable Software and Affected Versions: Windows DHCP Server affected versions not specified Description: The issue is related to a protection mechanism failure in Windows DHCP Server, allowing an unauthorized attacker to deny service over a network. Recommendations: At the moment,...

CVE-2025-38004

The CVE-2025-38004 entry affects the Linux kernel CAN BCM subsystem. A race allowed by updates to the currframe/count in bcm_can_tx() could enable user-space-triggered modifications from hrtimer context, leading to a KASAN slab-out-of-bounds read. The patch fixes by moving the count variable into...

D2R: Dual Regularization Loss with Collaborative Adversarial Generation for Model Robustness

The robustness of Deep Neural Network models is crucial for defending models against adversarial attacks. Recent defense methods have employed collaborative learning frameworks to enhance model robustness. Two key limitations of existing methods are i insufficient guidance of the target model via...

Enhancing Watermarking Quality for LLMs Via Contextual Generation States Awareness

Recent advancements in watermarking techniques have enabled the embedding of secret messages into AI-generated text AIGT, serving as an important mechanism for AIGT detection. Existing methods typically interfere with the generation processes of large language models LLMs to embed signals within...

CVE-2024-50406 License Center

A cross-site scripting XSS vulnerability has been reported to affect License Center. If exploited, the vulnerability could allow remote attackers who have gained user access to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version:...

The vulnerability in the fs/dlm/lock.c module of the Linux kernel’s locking mechanism allows a hacker to trigger a service failure.

The vulnerability in the fs/dlm/lock.c module of the Linux operating system’s locking manager, which involves pointer dereferencing errors. Exploiting this vulnerability can allow an attacker to cause a service failure...

BIT-JOOMLA-2024-27186 [20240803] - Core - XSS in HTML Mail Templates

The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions...

PCEvolve: Private Contrastive Evolution for Synthetic Dataset Generation Via Few-Shot Private Data and Generative APIs

The rise of generative APIs has fueled interest in privacy-preserving synthetic data generation. While the Private Evolution PE algorithm generates Differential Privacy DP synthetic images using diffusion model APIs, it struggles with few-shot private data due to the limitations of its DP-protect...

Differentially Private Distribution Release of Gaussian Mixture Models Via KL-Divergence Minimization

Gaussian Mixture Models GMMs are widely used statistical models for representing multi-modal data distributions, with numerous applications in data mining, pattern recognition, data simulation, and machine learning. However, recent research has shown that releasing GMM parameters poses significan...

Timing Side-channel Attacks

vllm is vulnerable to Timing side-channel attacks. The vulnerability is due to timing discrepancies during the prefill phase by the PageAttention mechanism reusing matching prefix chunks, which speeds up token generation and allows an attacker to infer prompt similarity or presence...

CVE-2025-4607

CVE-2025-4607 concerns the PSW Front-end Login & Registration plugin for WordPress (versions up to and including 1.12). The vulnerability arises from a weak, low-entropy OTP mechanism in the forget() function, enabling unauthenticated attackers to initiate a password reset for any user (including...

CVE-2025-48936

Zitadel is open-source identity infrastructure software. Prior to versions 2.70.12, 2.71.10, and 3.2.2, a potential vulnerability exists in the password reset mechanism. ZITADEL utilizes the Forwarded or X-Forwarded-Host header from incoming requests to construct the URL for the password reset...

Shill Bidding Prevention in Decentralized Auctions Using Smart Contracts

In online auctions, fraudulent behaviors such as shill bidding pose significant risks. This paper presents a conceptual framework that applies dynamic, behavior-based penalties to deter auction fraud using blockchain smart contracts. Unlike traditional post-auction detection methods, this approac...

Security update for ucode-intel

This update for ucode-intel fixes the following issues: Intel CPU Microcode was updated to the 20250512 release bsc1243123 CVE-2024-28956: Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution for some Intel Processors may allow an authenticated user...

SUSE-SU-2025:01651-2 Security update for ucode-intel

This update for ucode-intel fixes the following issues: Intel CPU Microcode was updated to the 20250512 release bsc1243123 - CVE-2024-28956: Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution for some Intel Processors may allow an authenticated us...

GHSA-4QJH-9FV9-R85R Potential Timing Side-Channel Vulnerability in vLLM’s Chunk-Based Prefix Caching

This issue arises from the prefix caching mechanism, which may expose the system to a timing side-channel attack. Description When a new prompt is processed, if the PageAttention mechanism finds a matching prefix chunk, the prefill process speeds up, which is reflected in the TTFT Time to First...

Potential Timing Side-Channel Vulnerability in vLLM’s Chunk-Based Prefix Caching

This issue arises from the prefix caching mechanism, which may expose the system to a timing side-channel attack. Description When a new prompt is processed, if the PageAttention mechanism finds a matching prefix chunk, the prefill process speeds up, which is reflected in the TTFT Time to First...