libxml2: XXE vulnerability

A flaw was found in libxml2. In the affected versions of libxml2, the SAX parser can generate events for external entities, even if custom SAX handlers try to override entity content by setting it to "checked." This vulnerability allows classic XML External Entity XXE attacks...

PT-2025-20888

Name of the Vulnerable Software and Affected Versions Bosch Infotainment ECU versions affected versions not specified Description The Infotainment ECU, manufactured by Bosch, utilizes an RH850 module for CAN communication. The RH850 module connects to the infotainment system via the INC interface...

PT-2025-20889

The system suffers from the absence of a kernel module signature verification. If an attacker can execute commands on behalf of root user due to additional vulnerabilities, then he/she is also able to load custom kernel modules to the kernel space and execute code in the kernel context. Such a fl...

PT-2025-20891

Name of the Vulnerable Software and Affected Versions Bosch Infotainment ECU versions affected versions not specified Description A flaw exists within the Bluetooth stack developed by Alps Alpine of the Infotainment ECU manufactured by Bosch. The issue is due to a lack of proper boundary validati...

Microsoft Defender 授权问题漏洞

Microsoft Defender is a threat protection software from Microsoft Corporation USA. An authorization issue vulnerability exists in Microsoft Defender. An attacker exploits this vulnerability to perform spoofing attacks...

Quantum Support Vector Regression for Robust Anomaly Detection

Anomaly Detection AD is critical in data analysis, particularly within the domain of IT security. In recent years, Machine Learning ML algorithms have emerged as a powerful tool for AD in large-scale data. In this study, we explore the potential of quantum ML approaches, specifically quantum kern...

Earth Ammit Disrupts Drone Supply Chains Through Coordinated Multi-Wave Attacks in Taiwan

Trend™ Research discusses the evolving tradecraft of threat actor Earth Ammit, proven by the advanced toolset used in its TIDRONE and VENOM campaigns that targeted the drone supply chain...

PT-2025-21008 · Microsoft · Windows Common Log File System Driver +1

Name of the Vulnerable Software and Affected Versions: Windows Common Log File System Driver affected versions not specified Description: The issue is related to improper input validation in the Windows Common Log File System Driver, which allows an authorized attacker to elevate privileges...

PT-2025-21003

Name of the Vulnerable Software and Affected Versions Windows Common Log File System Driver affected versions not specified Description The issue is related to a use-after-free vulnerability in the Windows Common Log File System Driver, which allows an authorized attacker to elevate privileges...

PT-2025-20986 · Microsoft · Office Excel

Name of the Vulnerable Software and Affected Versions: Microsoft Office Excel affected versions not specified Description: The issue allows an unauthorized attacker to execute code locally due to a 'type confusion' vulnerability, where a resource is accessed using an incompatible type. This...

x86: Indirect Target Selection

ISSUE DESCRIPTION Researchers at VU Amsterdam have released Training Solo, detailing several speculative attacks which bypass current protections. One issue, which Intel have named Indirect Target Selection, is a bug in the hardware support for prediction-domain isolation. The mitigation for this...

FakeUpdates, Remcos, AgentTesla Top Malware Charts in Stealth Attack Surge

Check Point's April 2025 malware report reveals increasingly sophisticated and hidden attacks using familiar malware like FakeUpdates, Remcos,…...

CVE-2025-46718

sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with limited sudo privileges e.g. execution of a single command can list sudo privileges of other users using the -U flag. This vulnerability allows users with limited sudo privileges to enumerat...

CVE-2023-34732

An issue in the userId parameter in the change password function of Flytxt NEON-dX v0.0.1-SNAPSHOT-6.9-qa-2-9-g5502a0c allows attackers to execute brute force attacks to discover user passwords...

CVE-2023-34732

The Flytxt NEON-dX software (specifically version v0.0.1-SNAPSHOT-6.9-qa-2-9-g5502a0c ) contains an Authenticated Function Abuse vulnerability. The change password function relies on the userId parameter instead of the authenticated session or token, allowing an attacker to brute-force other user...

CVE-2025-4539

CVE-2025-4539 affects Hainan ToDesk 4.7.6.3, due to an uncontrolled search path in the profapi.dll located in the DLL File Parser component. This enables a local-host attack; exploitation is described as high-complexity with public disclosure. No patch/version fix is provided in the sources; a te...

CVE-2025-4537 yangzongzhuan RuoYi-Vue Password login.vue sensitive information in a cookie

A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.8.9 and classified as problematic. Affected by this issue is some unknown functionality of the file ruoyi-ui/jsencrypt.js and ruoyi-ui/login.vue of the component Password Handler. The manipulation leads to cleartext storage of sensitive...

CVE-2025-4535

A vulnerability, which was classified as problematic, was found in Gosuncn Technology Group Audio-Visual Integrated Management Platform 4.0. Affected is an unknown function of the file /config/config.properties of the component Configuration File Handler. The manipulation leads to information...

RedTeamLLM: an Agentic AI Framework for Offensive Security

From automated intrusion testing to discovery of zero-day attacks before software launch, agentic AI calls for great promises in security engineering. This strong capability is bound with a similar threat: the security and research community must build up its models before the approach is leverag...

PT-2025-20656 · Sungrow · Sungrow Logger1000

Name of the Vulnerable Software and Affected Versions: SunGrow Logger1000 version 01 A Description: A problematic issue has been found in the software, affecting some unknown processing. The manipulation leads to weak password requirements. The attack may be initiated remotely. The complexity of ...