CVE-2025-54514

CVE-2025-54514 concerns an on-chip resource isolation flaw in AMD SoCs that could be exploited by a local privileged attacker to cause a partial loss of integrity. The issue is described in AMD security bulletins (AMD-SB-4013 and AMD-SB-3023) and is reflected across multiple feeds (NVD, OSV, Debi...

CVE-2025-54514

Improper isolation of shared resources on a system on a chip by a malicious local attacker with high privileges could potentially lead to a partial loss of integrity...

CVE-2025-54514

Improper isolation of shared resources on a system on a chip by a malicious local attacker with high privileges could potentially lead to a partial loss of integrity...

CVE-2026-24045

Docmost is open-source collaborative wiki and documentation software. From 0.20.0 and before 0.25.0, the public share page functionality in Docmost does not properly HTML-escape page titles before inserting them into meta tags and the title tag. This allows Stored Cross-Site Scripting XSS attacks...

CVE-2026-21231

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Kernel allows an authorized attacker to elevate privileges locally...

CVE-2026-21231

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Kernel allows an authorized attacker to elevate privileges locally...

CVE-2026-24045

Docmost is open-source collaborative wiki and documentation software. From 0.20.0 and before 0.25.0, the public share page functionality in Docmost does not properly HTML-escape page titles before inserting them into meta tags and the title tag. This allows Stored Cross-Site Scripting XSS attacks...

Windows Subsystem for Linux Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally...

nodejs: Nodejs denial of service

A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when pskCallback or ALPNCallback are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths tlsClientError and error, causing either immediate...

PT-2026-7336

Name of the Vulnerable Software and Affected Versions Windows Kernel affected versions not specified Description A flaw exists in the Windows Kernel related to concurrent execution using a shared resource with improper synchronization, creating a race condition. This can allow an authorized...

PT-2026-7341

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally...

CVE-2026-1584

A flaw was found in gnutls. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted ClientHello message with an invalid Pre-Shared Key PSK binder value during the TLS handshake. This can lead to a NULL pointer dereference, causing the server to crash and...

How Asem Eleraky went from a shared family PC to finding critical vulnerabilities

In the world of vulnerability research, origin stories are rarely linear. For Asem Eleraky, the path to becoming a Microsoft MVR began not in a SOC lab or a university classroom, but with a single family PC and a short daily window to explore his growing interest in cybersecurity...

The vulnerability of the WMI_TXSTATUS_EVENTID command in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the WMITXSTATUSEVENTID command in the Linux operating system’s kernel is related to the simultaneous execution using shared resources with incorrect synchronization. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the gfs2_show_options() function in the fs/gfs2/super.c file of the GFS2 file system in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the gfs2showoptions function in the fs/gfs2/super.c file of the GFS2 file system in the Linux operating system is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the loop_set_block_size() function in the drivers/block/loop.c module of the Linux kernel’s block devices driver allows a attacker to cause a service failure.

The vulnerability of the loopsetblocksize function in the drivers/block/loop.c module of the Linux kernel’s block devices driver is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerabilities of the functions drm_gem_shmem_vmap_locked() and drm_gem_shmem_vunmap_locked() in the module drivers/gpu/drm/drm_gem_shmem_helper.c of the Direct Rendering Infrastructure (DRI) driver for the Linux operating system allow a hacker to cause a service failure.

The vulnerabilities of the functions drmgemshmemvmaplocked and drmgemshmemvunmaplocked in the module drivers/gpu/drm/drmgemshmemhelper.c of the Direct Rendering Infrastructure DRI driver for the Linux kernel are related to pointer manipulation. Exploiting these vulnerabilities can allow an attack...

OESA-2026-1306 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: cacheinfo: Fix sharedcpumap to handle shared caches at different levels The cacheinfo sets up the sharedcpumap by checking whether the caches with the same index...

Cross-User Data Leakage

jsPDF is vulnerable to Cross-User Data Leakage. The vulnerability is due to use of a shared module-scoped variable in the addJS method, where JavaScript content is stored globally in the Node.js build, allowing concurrent PDF generation requests to overwrite each other’s data and cause one user’s...

CVE-2025-68699

NanoMQ MQTT Broker NanoMQ is an all-around Edge Messaging Platform. In version 0.24.6, NanoMQ has a protocol parsing / forwarding inconsistency when handling shared subscriptions $share/. A malformed SUBSCRIBE topic such as $share/ab missing the second / is not strictly validated during the...