CVE-2025-4539

CVE-2025-4539 affects Hainan ToDesk 4.7.6.3, due to an uncontrolled search path in the profapi.dll located in the DLL File Parser component. This enables a local-host attack; exploitation is described as high-complexity with public disclosure. No patch/version fix is provided in the sources; a te...

CVE-2025-4537 yangzongzhuan RuoYi-Vue Password login.vue sensitive information in a cookie

A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.8.9 and classified as problematic. Affected by this issue is some unknown functionality of the file ruoyi-ui/jsencrypt.js and ruoyi-ui/login.vue of the component Password Handler. The manipulation leads to cleartext storage of sensitive...

CVE-2025-4535

A vulnerability, which was classified as problematic, was found in Gosuncn Technology Group Audio-Visual Integrated Management Platform 4.0. Affected is an unknown function of the file /config/config.properties of the component Configuration File Handler. The manipulation leads to information...

RedTeamLLM: an Agentic AI Framework for Offensive Security

From automated intrusion testing to discovery of zero-day attacks before software launch, agentic AI calls for great promises in security engineering. This strong capability is bound with a similar threat: the security and research community must build up its models before the approach is leverag...

PT-2025-20656 · Sungrow · Sungrow Logger1000

Name of the Vulnerable Software and Affected Versions: SunGrow Logger1000 version 01 A Description: A problematic issue has been found in the software, affecting some unknown processing. The manipulation leads to weak password requirements. The attack may be initiated remotely. The complexity of ...

CVE-2025-46812

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.15 are vulnerable to XSS attacks when pasting malicious code. An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the...

About Elevation of Privilege – Windows Common Log File System Driver (CVE-2025-29824) vulnerability

About Elevation of Privilege - Windows Common Log File System Driver CVE-2025-29824 vulnerability. The vulnerability from the April Microsoft Patch Tuesday allows an attacker operating under a regular user account to escalate their privileges to SYSTEM level. According to Microsoft, the...

CVE-2025-4503 Campcodes Sales and Inventory System customer_update.php sql injection

A vulnerability was found in Campcodes Sales and Inventory System 1.0 and classified as critical. This issue affects some unknown processing of the file /pages/customerupdate.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has bee...

CVE-2025-4127

The WP SEO Structured Data Schema plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Price Range’ parameter in all versions up to, and including, 2.7.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

Sandcastles in the Storm: Revisiting the (Im)Possibility of Strong Watermarking

Watermarking AI-generated text is critical for combating misuse. Yet recent theoretical work argues that any watermark can be erased via random walk attacks that perturb text while preserving quality. However, such attacks rely on two key assumptions: 1 rapid mixing watermarks dissolve quickly...

PT-2025-20630 · Unknown · Sourcecodester Online College Library System

Name of the Vulnerable Software and Affected Versions: SourceCodester Online College Library System version 1.0 Description: A critical vulnerability was found in the SourceCodester Online College Library System. The issue is related to an unknown function of the file /index.php, where the...

K000151254: libxml2 vulnerability CVE-2024-40896

Security Advisory Description In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content by setting "checked". This makes classic XXE attacks possible. CVE-2024-40896...

CVE-2025-4382

A flaw was found in systems utilizing LUKS-encrypted disks with GRUB configured for TPM-based auto-decryption. When GRUB is set to automatically decrypt disks using keys stored in the TPM, it reads the decryption key into system memory. If an attacker with physical access can corrupt the underlyi...

Deploying AI Agents? Learn to Secure Them Before Hackers Strike Your Business

AI agents are changing the way businesses work. They can answer questions, automate tasks, and create better user experiences. But with this power comes new risks — like data leaks, identity theft, and malicious misuse. If your company is exploring or already using AI agents, you need to ask: Are...

CVE-2025-20937

Out-of-bounds write in Keymaster trustlet prior to SMR May-2025 Release 1 allows local privileged attackers to write out-of-bounds memory...

CVE-2025-20979

Out-of-bounds write in libsavscmn prior to Android 15 allows local attackers to execute arbitrary code...

Sparsification under Siege: Defending against Poisoning Attacks in Communication-Efficient Federated Learning

Federated Learning FL enables collaborative model training across distributed clients while preserving data privacy, yet it faces significant challenges in communication efficiency and vulnerability to poisoning attacks. While sparsification techniques mitigate communication overhead by...

NCorr-FP: a Neighbourhood-Based Correlation-Preserving Fingerprinting Scheme for Intellectual Property Protection of Structured Data

Ensuring data ownership and traceability of unauthorised redistribution are central to safeguarding intellectual property in shared data environments. Data fingerprinting addresses these challenges by embedding recipient-specific marks into the data, typically via content modifications. We propos...

A Taxonomy of Attacks and Defenses in Split Learning

Split Learning SL has emerged as a promising paradigm for distributed deep learning, allowing resource-constrained clients to offload portions of their model computation to servers while maintaining collaborative learning. However, recent research has demonstrated that SL remains vulnerable to a...

PT-2025-20459 · Unknown · Project Worlds Car Rental Project

Name of the Vulnerable Software and Affected Versions: Project Worlds Car Rental Project version 1.0 Description: A critical vulnerability has been found in the Project Worlds Car Rental Project. The issue affects an unknown function of the file /signup.php. The manipulation of the fname argument...