CVE-2025-11577

Clevo’s UEFI firmware update packages, including B10717.exe, inadvertently contained private signing keys used for Boot Guard and Boot Policy Manifest verification. The exposure of these keys could allow attackers to sign malicious firmware that appears trusted by affected systems, undermining th...

CVE-2025-11577 Clevo UEFI firmware exposed Boot Guard private keys, enabling potential abuse of the Boot Guard trust chain

Clevo’s UEFI firmware update packages, including B10717.exe, inadvertently contained private signing keys used for Boot Guard and Boot Policy Manifest verification. The exposure of these keys could allow attackers to sign malicious firmware that appears trusted by affected systems, undermining th...

September 9, 2025—KB5065429 (OS Builds 19044.6332 and 19045.6332)

None None...

September 9, 2025—KB5065428 (OS Build 17763.7792)

None None...

October 23, 2025—KB5070886 (Monthly Rollup) Out-of-band

None None...

KB5066840: Cumulative security update for Internet Explorer: October 14, 2025

None None...

September 9, 2025—KB5065431 (OS Builds 22621.5909 and 22631.5909)

None None...

September 9, 2025—KB5065432 (OS Build 20348.4171)

None None...

Cert CC: CVE-2025-2884 Out-of-Bounds read vulnerability in TCG TPM2.0 reference implementation

CVE-2025-2884 is regarding a vulnerability in TCG TPM2.0 Reference implementation's CryptHmacSign helper function that is vulnerable to Out-of-Bounds read due to the lack of validation the signature scheme with the signature key's algorithm. CERT/CC created this CVE on their behalf. The documente...

CVE-2025-7329 Rockwell Automation Comms - 1783-NATR Stored Cross-Site Scripting Vulnerability

A Stored Cross-Site Scripting security issue exists in the affected product that could potentially allow a malicious user to view and modify sensitive data or make the webpage unavailable. The vulnerability stems from missing special character filtering and encoding. Successful exploitation...

Security Updates for Microsoft Office Online Server (October 2025)

The Microsoft Office Online Server installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities. - Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. CVE-2025-59223, CVE-2025-59224, CVE-2025-5922...

AMD Secure Processor Security Update

AMD has informed HP of a potential security vulnerability in some AMD Secure Processors, which might allow loss of integrity or confidentiality. AMD has released firmware updates to mitigate this vulnerability. AMD has released updates to mitigate the potential vulnerability. HP has identified...

Virtuozzo Hybrid Infrastructure 6.2 Update 1 Hotfix 7 (6.2.1-97)

This update provides stability fixes and support for cumulative updates. Clusters running version 6.2.1 or later can now upgrade directly to the latest available version in a single step. Vulnerability id: VSTOR-91715 Failed to retry updating the kernel. Vulnerability id: VSTOR-93149, VSTOR-10082...

Ubuntu: Security Advisory (USN-7819-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Sound Research SECOMNService Escalation of Privilege

Potential vulnerabilities have been identified in the audio package for certain HP PC products using the Sound Research SECOMN64 driver, which might allow escalation of privilege. HP is releasing updated audio packages to mitigate the potential vulnerabilities The Sound Research Effects Driver...

Clevo UEFI security vulnerabilities

Clevo UEFI is a firmware interface from Blue Sky Computer Clevo of Taiwan, China. A security vulnerability exists in Clevo UEFI that stems from the inclusion of a private signing key in firmware update packages, which could lead to malicious firmware being trusted...

KB5066795: Servicing stack update for Windows Server 2012: October 14, 2025

None None...

Security Updates for Microsoft SharePoint Server Subscription Edition (October 2025)

The Microsoft SharePoint Server Subscription Edition installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Remote Code Execution Vulnerability. CVE-2025-59228, CVE-2025-59237 - Information Disclosure Vulnerability CVE-2025-59235...

Security Updates for Microsoft Office Products (October 2025)

The Microsoft Office Products are missing security updates. They are, therefore, affected by multiple vulnerabilities. - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. CVE-2025-59226, CVE-2025-59227,...

Security Updates for Azure Connected Machine Agent < 1.56 (October 2025)

The Microsoft Azure Connected Machine Agent installation on the remote host is missing security updates. It is, therefore, affected by an elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges. Note that Nessus has not tested for this issue but has instead...