CVE-2025-20996

Improper authorization in Smart Switch installed on non-Samsung Device prior to version 3.7.64.10 allows local attackers to read data with the privilege of Smart Switch. User interaction is required for triggering this vulnerability...

CVE-2025-20984

Samsung Cloud for Galaxy Watch (prior to SMR Jun-2025 Release 1) is affected by an incorrect default permission setting that could allow local attackers to access data stored in Samsung Cloud for Galaxy Watch. The issue is tied to Samsung’s Galaxy Watch cloud data permissions and is mitigated by ...

CVE-2025-20984

Incorrect default permission in Samsung Cloud for Galaxy Watch prior to SMR Jun-2025 Release 1 allows local attackers to access data in Samsung Cloud for Galaxy Watch...

PT-2025-23746

Name of the Vulnerable Software and Affected Versions Samsung Cloud for Galaxy Watch versions prior to SMR Jun-2025 Release 1 Description The issue is related to an incorrect default permission setting in Samsung Cloud for Galaxy Watch, allowing local attackers to access data. This could...

PT-2025-23757 · Samsung · Smart Switch Pc

Name of the Vulnerable Software and Affected Versions: Smart Switch versions prior to 3.7.64.10 Description: The issue is related to improper authorization, allowing local attackers to read data with the privilege of Smart Switch on non-Samsung devices. User interaction is required to trigger thi...

Privacy and Security Threat for OpenAI GPTs

Large language models LLMs demonstrate powerful information handling capabilities and are widely integrated into chatbot applications. OpenAI provides a platform for developers to construct custom GPTs, extending ChatGPT's functions and integrating external services. Since its release in November...

DALIBO PostgreSQL Anonymizer 安全漏洞

DALIBO PostgreSQL Anonymizer is an extension for masking or replacing personally identifiable information PII or commercially sensitive data in PostgreSQL databases from France DALIBO. A security vulnerability exists in DALIBO PostgreSQL Anonymizer version v2.0 and v2.1, which stems from a...

PT-2025-23795 · Unknown · Airleader Master

Name of the Vulnerable Software and Affected Versions: airleader MASTER version 3.0046 Description: The issue allows retrieval of embedded sensitive data due to a Path Traversal vulnerability. This vulnerability enables access to sensitive information embedded within the system. Recommendations:...

CVE-2025-4047

The Broken Link Checker plugin for WordPress is vulnerable to unauthorized data access due to a missing capability check on the ajaxfullstatus and ajaxdashboardstatus functions in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2025-4047 Broken Link Checker <= 2.4.4 - Missing Autorization to Authenticated (Subscriber+) Plugin Status Dashboard View

The Broken Link Checker plugin for WordPress is vulnerable to unauthorized data access due to a missing capability check on the ajaxfullstatus and ajaxdashboardstatus functions in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with Subscriber-level...

openjdk: Enhance Buffered Image handling (Oracle CPU 2025-04)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: 2D. Supported versions that are affected are Oracle Java SE: 8u441, 8u441-perf, 11.0.26, 17.0.14, 21.0.6, 24; Oracle GraalVM for JDK: 17.0.14, 21.0.6, 24; Oracle...

PT-2025-23565 · WordPress · Broken Link Checker

Name of the Vulnerable Software and Affected Versions: Broken Link Checker plugin for WordPress versions up to, and including, 2.4.4 Description: The issue is related to unauthorized data access due to a missing capability check on the ajax full status and ajax dashboard status functions. This...

Hash Collision Attack

vllm is vulnerable to hash collision and data integrity issues. The vulnerability is due to improper image serialization using only raw pixel bytes without metadata, allowing attackers to create images with identical hashes and exploit cache poisoning or access sensitive data...

Carestream Health Clinical Collaboration Platform 命令注入漏洞

Carestream Health Clinical Collaboration Platform is a clinical assistance platform from Carestream Health, USA. A security vulnerability exists in Carestream Health Clinical Collaboration Platform version 12.2.1.5, which stems from an issue with the session management component that could lead t...

The vulnerability of the NVIDIA GPU Display Driver allows a malicious individual to gain unauthorized access to modify data, expose sensitive information, or cause service failures.

The vulnerability of the NVIDIA GPU Display Driver software driver is related to the execution of operations beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to data, disclose confidential information, or cause system failures...

What does Facebook know about me? (Lock and Code S06E11)

This week on the Lock and Code podcast … There's an easy way to find out what Facebook knows about you—you just have to ask. In 2020, the social media giant launched an online portal that allows all users to access their historical data and to request specific types of information for download...

CVE-2025-46823

openmrs-module-fhir2 provides the FHIR REST API and related services for OpenMRS, an open medical records system. In versions of the FHIR2 module prior to 2.5.0, privileges were not always correctly checked, which means that unauthorized users may have been able to add or edit data they were not...

CLSA-2025-1748629211 java-11-openjdk: Fix of 3 CVEs

Upgrade to openjdk-11.0.27+6 GA. The following CVEs were fixed: - CVE-2025-21587: fix TLS connection support to avoid unauthorized access to critical data - CVE-2025-30698: fix buffered image handling to avoid unauthorized access to accessible data - CVE-2025-30691: improve compiler...

CVE-2025-48912 Apache Superset: Improper authorization bypass on row level security via SQL Injection

An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects...

CVE-2025-48912 Apache Superset: Improper authorization bypass on row level security via SQL Injection

An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects...