CVE-2025-7639

The vulnerability, if exploited, could allow an authenticated miscreant with "DNA Authority - Operator" privilege to tamper with serialized data, potentially resulting in code execution during deserialization under the privilege of Enterprise SCADA security group "DNA Apps"...

EUVD-2025-210730

The vulnerability, if exploited, could allow an authenticated miscreant with "DNA Authority - Operator" privilege to tamper with serialized data, potentially resulting in code execution during deserialization under the privilege of Enterprise SCADA security group "DNA Apps"...

CVE-2025-7639

The vulnerability affects AVEVA Enterprise SCADA , a SCADA system deployed in Critical Manufacturing sectors worldwide. The root cause is deserialization of untrusted data : an authenticated user with "DNA Authority - Operator" privilege can tamper with serialized data, triggering arbitrary code ...

GLSA-202608-11 : haveged: Privilege escalation

The remote host is affected by the vulnerability described in GLSA-202608-11 haveged: Privilege escalation A vulnerability has been discovered in haveged. Please review the CVE identifier referenced below for details. Tenable has extracted the preceding description block directly from the Gentoo...

CVE-2025-7639: Deserialization of Untrusted Data

The vulnerability, if exploited, could allow an authenticated miscreant with "DNA Authority - Operator" privilege to tamper with serialized data, potentially resulting in code execution during deserialization under the privilege of Enterprise SCADA security group "DNA Apps"...

The vulnerability of the Microsoft Power Apps development environment, related to incorrect authentication, allows a perpetrator to increase their privileges.

The vulnerability of the Microsoft Power Apps development environment is related to improper authentication. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

The vulnerability of Microsoft Office packages and 365 Apps for Enterprise allows a perpetrator to disclose protected information.

The vulnerability of Microsoft Office packages and 365 Apps for Enterprise lies in reading data beyond the allowed range in memory. Exploiting this vulnerability can allow an attacker to disclose protected information...

The vulnerability in Microsoft Word, Microsoft Office suites, and Microsoft 365 Apps for Enterprise allows a perpetrator to disclose protected information.

The vulnerability of Microsoft Word, the Microsoft Office suite, and Microsoft 365 Apps for Enterprise involves reading data beyond the allowed range in memory. Exploiting this vulnerability can allow an attacker to disclose protected information...

CVE-2026-73655: Improper Authentication

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.2, addGoogleStrategy in apps/webapp/app/services/googleAuth.server.ts passes a Google profile email to findOrCreateGoogleUser in apps/webapp/app/models/user.server.ts without requiring Google'...

CVE-2026-73659: Improper Limitation of a Pathname to a Restricted Directory

Trigger.dev is the open-source platform for building AI workflows in TypeScript. From 4.4.2 until 4.5.0, the packet presign routes in apps/webapp/app/routes/api.v1.packets.$.ts pass a caller-controlled filename through resolveStoreProtocolForPacketPresign to generatePresignedUrl and...

The vulnerability of the cloud platform used for creating and launching automated work processes in Azure Logic Apps relates to operational systems running on Windows. This vulnerability stems from deficiencies in access control, allowing attackers to exploit it to disclose sensitive information.

The vulnerability of the cloud platform used for creating and launching automated work processes in Azure Logic Apps, when operating on Windows operating systems, is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to disclose sensitive...

The vulnerability of Microsoft PowerPoint presentation preparation programs, Microsoft Office packages, and 365 Apps for Enterprise, related to insufficient validation of input data, allows attackers to disclose protected information.

The vulnerability of Microsoft PowerPoint presentation templates, Microsoft Office packages, and 365 Apps for Enterprise lies in insufficient validation of input data. Exploiting this vulnerability can allow attackers to disclose protected information...

The vulnerability of the Microsoft Outlook client, Microsoft Office packages, and 365 Apps for Enterprise, related to a potential overflow condition, allows an attacker to execute arbitrary code.

The vulnerability of the Microsoft Outlook client, Microsoft Office packages, and 365 Apps for Enterprise is related to a numerical overflow vulnerability. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending a specially crafted malicious file...

The vulnerability of Microsoft Excel, Microsoft Office, and 365 Apps for Enterprise programs, related to data type conversion errors, allows attackers to execute arbitrary code.

The vulnerability of Microsoft Excel, Microsoft Office, and 365 Apps for Enterprise programs is related to data type conversion errors. Exploiting this vulnerability can allow attackers to execute arbitrary code by sending a specially crafted malicious file...

Debian dsa-6432 : flatpak - security update

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6432 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6432-1 [email protected] https://www.debian.org/security/ Moritz...

Vulnerabilities in Microsoft Dynamics

Microsoft has identified vulnerabilities in Dynamics, both online and on-premise. These vulnerabilities allow a malicious individual to gain elevated privileges, execute arbitrary code, and/or access sensitive data. The most severe vulnerability has been assigned the CVE-2026-59118 identifier and...

Project CAV3RN continues: Google Apps Script as C2 relay and DNS-based C2 channel selection

Project CAV3RN is a modular espionage framework used against targets in Israel. This report expands on two earlier publications: the first was published in June 2026 as part of our Kaspersky Threat Intelligence Reporting service, and the second was published on Securelist the following month,...

CVE-2026-5303

The ACAP framework contains a Time-of-Check to Time-of-Use TOCTOU race condition, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces...

EUVD-2026-55966

The ACAP framework contains a Time-of-Check to Time-of-Use TOCTOU race condition, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces...

EUVD-2026-55965

An ACAP configuration file lacks input validation, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a maliciou...