OESA-2025-1974 unbound security update

Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most...

MALRIS: Malicious Hardware in RIS-Assisted Wireless Communications

Reconfigurable intelligent surfaces RIS enhance wireless communication by dynamically shaping the propagation environment, but their integration introduces hardware-level security risks. This paper presents the concept of Malicious RIS MALRIS, where compromised components behave adversarially, ev...

Linux Distros Unpatched Vulnerability : CVE-2019-11707

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware ...

EG4 Electronics EG4 Inverters 安全漏洞

EG4 Electronics EG4 Inverters is a series of hybrid inverters from EG4 Electronics, USA. A security vulnerability exists in the EG4 Electronics EG4 Inverters that stems from an unlimited number of PIN attempts leading to a brute force cracking attack...

Microarchitectural Attacks on the Stack Engine

Summary Researchers from ETH Zurich have published a paper titled “One Flew over the Stack Engine’s Nest: Practical Microarchitectural Attacks on the Stack Engine.” AMD continues to recommend software developers employ existing best practices including constant time algorithm and avoid...

Webinar: How to Stop Python Supply Chain Attacks—and the Expert Tools You Need

Python is everywhere in modern software. From machine learning models to production microservices, chances are your code—and your business—depends on Python packages you didn't write. But in 2025, that trust comes with a serious risk. Every few weeks, we're seeing fresh headlines about malicious...

6,500 Servers Expose Axis Remoting Protocol; 4,000 in U.S. Vulnerable to Exploits

Cybersecurity researchers have disclosed multiple security flaws in video surveillance products from Axis Communications that, if successfully exploited, could expose them to takeover attacks. "The attack results in pre-authentication remote code execution on Axis Device Manager, a server used to...

SonicWall Confirms Patched Vulnerability Behind Recent VPN Attacks, Not a Zero-Day

SonicWall has revealed that the recent spike in activity targeting its Gen 7 and newer firewalls with SSL VPN enabled is related to an older, now-patched bug and password reuse. "We now have high confidence that the recent SSL VPN activity is not connected to a zero-day vulnerability," the compan...

Secure and Practical Quantum Digital Signatures

Digital signatures represent a crucial cryptographic asset that must be protected against quantum adversaries. Quantum Digital Signatures QDS can offer solutions that are information-theoretically IT secure and thus immune to quantum attacks. In this work, we analyze three existing practical QDS...

Non-Omniscient Backdoor Injection with a Single Poison Sample: Proving the One-Poison Hypothesis for Linear Regression and Linear Classification

Backdoor injection attacks are a threat to machine learning models that are trained on large data collected from untrusted sources; these attacks enable attackers to inject malicious behavior into the model that can be triggered by specially crafted inputs. Prior work has established bounds on th...

PT-2025-32318 · Wanzhou · Woes Intelligent Optimization Energy Saving System

Name of the Vulnerable Software and Affected Versions: Wanzhou WOES Intelligent Optimization Energy Saving System version 1.0 Description: A vulnerability exists in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0. The issue involves SQL injection due to the manipulation of the...

Linux Distros Unpatched Vulnerability : CVE-2024-21201

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.39 and prior, 8.4.2 and pri...

Linux Distros Unpatched Vulnerability : CVE-2022-45420

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resulting in potential user...

Linux Distros Unpatched Vulnerability : CVE-2021-35591

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DML. Supported versions that are affected are 8.0.26 and prior. Easily exploitable...

Driver of destruction: How a legitimate driver is being used to take down AV processes

Introduction In a recent incident response case in Brazil, we spotted intriguing new antivirus AV killer software that has been circulating in the wild since at least October 2024. This malicious artifact abuses the ThrottleStop.sys driver, delivered together with the malware, to terminate numero...

CERT-UA Warns of HTA-Delivered C# Malware Attacks Using Court Summons Lures

The Computer Emergency Response Team of Ukraine CERT-UA has warned of cyber attacks carried out by a threat actor called UAC-0099 targeting government agencies, the defense forces, and enterprises of the defense-industrial complex in the country. The attacks, which leverage phishing emails as an...

CVE-2025-21021

Out-of-bounds write in drawing pinpad in Blockchain Keystore prior to version 1.3.17.2 allows local privileged attackers to write out-of-bounds memory...

CVE-2025-21010

CVE-2025-21010 affects SamsungAccount prior to SMR Aug-2025 Release 1. The root cause is improper privilege management that can allow a local attacker with high privileges to deactivate a Samsung account. Impact is feasible deactivation with local access; CVSS v3.1 vector: AV:L/AC:L/PR:H/UI:N/S:C...

AuthPrint: Fingerprinting Generative Models against Malicious Model Providers

Generative models are increasingly adopted in high-stakes domains, yet current deployments offer no mechanisms to verify the origin of model outputs. We address this gap by extending model fingerprinting techniques beyond the traditional collaborative setting to one where the model provider may a...

PT-2025-32109 · Unknown · Blockchain Keystore

Name of the Vulnerable Software and Affected Versions: Blockchain Keystore versions prior to 1.3.17.2 Description: An out-of-bounds read issue exists in Blockchain Keystore. This allows local privileged attackers to read out-of-bounds memory. Recommendations: Update Blockchain Keystore to version...