Moodle allows IDOR when accessing the cohorts report

A flaw was discovered in Moodle. Additional checks were required to ensure that users can only access cohort data they are authorized to retrieve...

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes. The following security bugs were fixed: CVE-2024-27415: netfilter: brnetfilter: skip conntrack input hook for promisc packets bsc1224757. CVE-2024-50038: netfilter: xtables: fix typo causing so...

CVE-2025-3923

The CVE-2025-3923 entry describes a vulnerability in the WordPress plugin Prevent Direct Access – Protect WordPress Files for WordPress, affecting all versions up to 2.8.8. The issue is Sensitive Information Exposure caused by insufficient randomness in the generate_unique_string function, enabli...

CVE-2025-46547

CVE-2025-46547 : In Sherpa Orchestrator 141851, the web application lacks CSRF protection, enabling an attacker to perform actions such as XSS, adding a new user or role, or triggering SQL injection. The issue is documented across multiple sources (NVD/Red Hat/CIRCL/CVE list) with similar descrip...

Protecting Your Phone—and Your Privacy—at the US Border

In this episode of Uncanny Valley, our hosts explain how to prepare for travel to and from the United States—and how to stay safe...

GO-2025-3638 ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Before version 1.7.0, utls did not implement the TLS 1.3 downgrade protection mechanism specified in RFC 8446 Section 4.1.3 when using a utls ClientHello spec. This allowed an active network adversary to downgrade TLS 1.3 connections initiated by a utls client to a lower TLS version e.g., TLS 1.2...

CVE-2025-39408

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in EverPress BruteGuard – Brute Force Login Protection bruteguard allows Reflected XSS.This issue affects BruteGuard – Brute Force Login Protection: from n/a through = 0.1.4...

CVE-2025-39408 WordPress BruteGuard – Brute Force Login Protection plugin <= 0.1.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in EverPress BruteGuard – Brute Force Login Protection allows Reflected XSS. This issue affects BruteGuard – Brute Force Login Protection: from n/a through 0.1.4...

CVE-2025-39408

CVE-2025-39408 describes a reflected cross-site scripting (XSS) vulnerability in the WordPress plugin BruteGuard – Brute Force Login Protection, due to improper neutralization of input during web page generation. Affected versions are BruteGuard – Brute Force Login Protection up to 0.1.4. The con...

ALBEDO Telecom Net.Time - PTP/NTP clock

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to transmit passwords over unencrypted connections, resulting in the product becoming vulnerable to interception. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of...

PT-2025-27987

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.1.147-1 Debian bookworm, 6.6.101 upstream, and SLE 15 SP4, SLE 15 SP5, SLE 15 SP6, and openSUSE Leap 15.4, 15.5. Description The Linux kernel contains a vulnerability related to a use-after-free condition in th...

CVE-2025-32968

XWiki is a generic wiki platform. In versions starting from 1.6-milestone-1 to before 15.10.16, 16.4.6, and 16.10.1, it is possible for a user with SCRIPT right to escape from the HQL execution context and perform a blind SQL injection to execute arbitrary SQL statements on the database backend...

Draw the Line: Smart Consolidation or Bloated Platformization?

Running short on time but still want to stay in the know? Well, we’ve got you covered! We’ve condensed all the key takeaways into a handy audio summary. Our AI-driven podcasts are fit for on the go. Click right here to hear it all on Smart Consolidation vs Platformization. I often wonder…have CIS...

uTLS ServerHellos are accepted without checking TLS 1.3 downgrade canaries

Description Before version 1.7.0, utls did not implement the TLS 1.3 downgrade protection mechanism specified in RFC 8446 Section 4.1.3 when using a utls ClientHello spec. This allowed an active network adversary to downgrade TLS 1.3 connections initiated by a utls client to a lower TLS version...

GHSA-PMC3-P9HX-JQ96 uTLS ServerHellos are accepted without checking TLS 1.3 downgrade canaries

Description Before version 1.7.0, utls did not implement the TLS 1.3 downgrade protection mechanism specified in RFC 8446 Section 4.1.3 when using a utls ClientHello spec. This allowed an active network adversary to downgrade TLS 1.3 connections initiated by a utls client to a lower TLS version...

CVE-2025-0618

A malicious third party could invoke a persistent denial of service vulnerability in FireEye EDR agent by sending a specially-crafted tamper protection event to the HX service to trigger an exception. This exception will prevent any further tamper protection events from being processed, even afte...

CVE-2025-0618

CVE-2025-0618 affects Trellix Endpoint Security (HX) Server versions 10.0.2 and earlier. A specially crafted tamper protection event can trigger an unhandled exception in the HX service, causing a persistent denial of service that prevents processing of any further tamper protection events, even ...

CVE-2025-0618

A malicious third party could invoke a persistent denial of service vulnerability in FireEye EDR agent by sending a specially-crafted tamper protection event to the HX service to trigger an exception. This exception will prevent any further tamper protection events from being processed, even afte...

CVE-2025-0618

A malicious third party could invoke a persistent denial of service vulnerability in FireEye EDR agent by sending a specially-crafted tamper protection event to the HX service to trigger an exception. This exception will prevent any further tamper protection events from being processed, even afte...

Google Drops Cookie Prompt in Chrome, Adds IP Protection to Incognito

Google on Tuesday revealed that it will no longer offer a standalone prompt for third-party cookies in its Chrome browser as part of its Privacy Sandbox initiative. "We've made the decision to maintain our current approach to offering users third-party cookie choice in Chrome, and will not be...