CVE-2025-24331

The CVE-2025-24331 entry concerns Nokia’s Single RAN baseband OAM service. Versions prior to 24R1-SR 0.2 MP start as root and retain capabilities after dropping to unprivileged, potentially enabling actions beyond the intended scope (e.g., root access or modifying root-owned files). The issue has...

PT-2025-27363

Name of the Vulnerable Software and Affected Versions Airoha Bluetooth audio SDK affected versions not specified Beats Studio Buds versions prior to 1B211 Description An incorrect authorization flaw in the Airoha Bluetooth audio SDK allows a Bluetooth audio device to be paired without user consen...

[SECURITY] Fedora 41 Update: trafficserver-9.2.11-1.fc41

Traffic Server is a high-performance building block for cloud services. It's more than just a caching proxy server; it also has support for plugins to build large scale web applications. Key features: Caching - Improve your response time, while reducing server load and bandwidth needs by caching...

CVE-2025-49981

Missing Authorization vulnerability in mahabub81 User Roles and Capabilities user-roles-and-capabilities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Roles and Capabilities: from n/a through = 1.2.6...

Understanding Iranian Capabilities and Hacktivist Activities

Understanding Iranian Capabilities and Hacktivist Activities By John Fokker · June 23, 2025 As geopolitical tensions flare again in the Middle East, cyber operations are increasingly becoming an extension of physical conflict. State-aligned threat actors, patriotic hackers, and ideologically...

CVE-2025-38044

In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: set devicecaps for 417 The videodevice for the MPEG encoder did not set devicecaps. Add this, otherwise the video device can't be registered you get a WARNON instead. Not seen before since currently 417 support is...

CVE-2025-49981 WordPress User Roles and Capabilities plugin <= 1.2.6 - Broken Access Control Vulnerability

Missing Authorization vulnerability in mahabub81 User Roles and Capabilities user-roles-and-capabilities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Roles and Capabilities: from n/a through = 1.2.6...

WordPress plugin User Roles and Capabilities 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

CVE-2022-50117

In the Linux kernel, the following vulnerability has been resolved: vfio: Split migration ops from main device ops vfio core checks whether the driver sets some migration op e.g. setstate/getstate and accordingly calls its op. However, currently mlx5 driver sets the above ops without regards to i...

DEBIAN-CVE-2025-38044

In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: set devicecaps for 417 The videodevice for the MPEG encoder did not set devicecaps. Add this, otherwise the video device can't be registered you get a WARNON instead. Not seen before since currently 417 support is...

CVE-2025-38044

CVE-2025-38044 affects the Linux kernel cx231xx media subsystem. The video_device for the MPEG encoder did not set device_caps, preventing registration and causing a WARN_ON. The fix adds device_caps for the 417 decoder path so the video device can register normally. This addresses a local-priori...

CVE-2025-38044 media: cx231xx: set device_caps for 417

In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: set devicecaps for 417 The videodevice for the MPEG encoder did not set devicecaps. Add this, otherwise the video device can't be registered you get a WARNON instead. Not seen before since currently 417 support is...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel, which originates from the media driver not setting devicecaps for MPEG encoders...

OESA-2025-1626 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix WRITESAME No Data Buffer crash In newer version of the SBC specs, we have a NDOB bit that indicates there is no data buffer that gets written...

Introducing New Networking Capabilities for LKE-Enterprise

Modern enterprise applications require a robust, scalable, and secure networking infrastructure...

Newly identified wiper malware “PathWiper” targets critical infrastructure in Ukraine

Cisco Talos observed a destructive attack on a critical infrastructure entity within Ukraine, using a previously unknown wiper we are calling "PathWiper". The attack was instrumented via a legitimate endpoint administration framework, indicating that the attackers likely had access to the...

Asymmetry by Design: Boosting Cyber Defenders with Differential Access to AI

As AI-enabled cyber capabilities become more advanced, we propose "differential access" as a strategy to tilt the cybersecurity balance toward defense by shaping access to these capabilities. We introduce three possible approaches that form a continuum, becoming progressively more restrictive for...

BLACKOUT: Data-Oblivious Computation with Blinded Capabilities

Lack of memory-safety and exposure to side channels are two prominent, persistent challenges for the secure implementation of software. Memory-safe programming languages promise to significantly reduce the prevalence of memory-safety bugs, but make it more difficult to implement...

Evaluating AI Cyber Capabilities with Crowdsourced Elicitation

As AI systems become increasingly capable, understanding their offensive cyber potential is critical for informed governance and responsible deployment. However, it's hard to accurately bound their capabilities, and some prior evaluations dramatically underestimated them. The art of extracting...

CVE-2024-31995

@digitalbazaar/zcap provides JavaScript reference implementation for Authorization Capabilities. Prior to version 9.0.1, when invoking a capability with a chain depth of 2, i.e., it is delegated directly from the root capability, the expires property is not properly checked against the current da...