CVE-2025-64308: Unprotected Transport of Credentials

The Brightpick Mission Control web application exposes hardcoded credentials in its client-side JavaScript bundle to Brightpick AI's documentation portal...

Metasploit Wrap-Up 11/14/2025

It has “SUS” in the name, what did you expect? This week’s release features the much-hyped CVE-2025-59287, a Critical-Severity Windows Server Update Service WSUS vulnerability that allows for SYSTEM level remote code execution. Documented among the multiple recent zero-days in Windows, the...

Data Poisoning Vulnerabilities across Healthcare AI Architectures: A Security Threat Analysis

Healthcare AI systems face major vulnerabilities to data poisoning that current defenses and regulations cannot adequately address. We analyzed eight attack scenarios in four categories: architectural attacks on convolutional neural networks, large language models, and reinforcement learning...

OPENSUSE-SU-2025:15732-1 python-Scrapy-doc-2.13.3-2.1 on GA media

These are all security issues fixed in the python-Scrapy-doc-2.13.3-2.1 package on the GA media of openSUSE Tumbleweed...

CVE-2025-11997: Exposure of Sensitive Information to an Unauthorized Actor

The Document Pro Elementor – Documentation & Knowledge Base plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.9. This is due to the plugin exposing sensitive Algolia API keys through the frontend JavaScript code via wplocalizescript without prope...

Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2025-20558)

The remote Oracle Linux 10 / 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-20558 advisory. 6.12.0-103.40.4.2.el10uek - x86/vmscape: Warn when STIBP is disabled with SMT Pawan Gupta Orabug: 38343659 - x86/bugs: Move cpubugssmtupdate down Pawan...

Oracle Linux 8 : kernel (ELSA-2025-19931)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-19931 advisory. - fs: fix UAF/GPF bug in nilfsmdtdestroy Abhi Das RHEL-116658 CVE-2022-50367 - x86/vmscape: Add old Intel CPUs to affected list Waiman Long RHEL-11428...

Oracle Linux 9 : kernel (ELSA-2025-19930)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-19930 advisory. - x86/vmscape: Add old Intel CPUs to affected list Waiman Long RHEL-114270 CVE-2025-40300 - x86/vmscape: Warn when STIBP is disabled with SMT Waiman...

[SECURITY] Fedora 42 Update: qt5-qtdoc-5.15.18-1.fc42

QtDoc contains the main Qt Reference Documentation, which includes overviews, Qt topics, and examples not specific to any Qt module...

[SECURITY] Fedora 43 Update: python-fastapi-0.120.1-1.fc43

FastAPI is a modern, fast high-performance, web framework for building APIs with Python based on standard Python type hints. The key features are: =E2=80=A2 Fast: Very high performance, on par with NodeJS and Go thanks to Starlette and Pydantic. One of the fastest Python frameworks available...

[SECURITY] Fedora 43 Update: python-annotated-doc-0.0.3-2.fc43

Document parameters, class attributes, return types, and variables inline, wi th Annotated...

Security Bulletin: NVIDIA RunAI - November 2025

NVIDIA has released a software update for NVIDIA® RunAI. To protect your system, download and install the latest version of NVIDIA RunAI by following the instructions on the documentation site. Go to NVIDIA Product Security...

MINI-V2P2-576Q-WR2M

Bulletin has no description...

[SECURITY] Fedora 42 Update: zeal-0.7.2-14.fc42

Zeal is a simple offline documentation browser inspired by Dash...

Security Vulnerabilities in AI-Generated Code: A Large-Scale Analysis of Public GitHub Repositories

This paper presents a comprehensive empirical analysis of security vulnerabilities in AI-generated code across public GitHub repositories. We collected and analyzed 7,703 files explicitly attributed to four major AI tools: ChatGPT 91.52%, GitHub Copilot 7.50%, Amazon CodeWhisperer 0.52%, and...

CVE-2025-61235

A lack of improper input validation in Dataphone A920 v2025.07.161103 allows an attacker to craft a custom packet based on public documentation. Because the device fails to validate certain fields, it accepts the packet without authentication and triggers the associated functionality. The impact ...

[SECURITY] Fedora 43 Update: gi-docgen-2025.5-1.fc43

GI-DocGen is a document generator for GObject-based libraries. GObject is the base type system of the GNOME project. GI-Docgen reuses the introspection data generated by GObject-based libraries to generate the API reference of these libraries, as well as other ancillary documentation. GI-DocGen i...

[SECURITY] Fedora 43 Update: python3.12-3.12.12-1.fc43

Python 3.12 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.12 package provides the "python3.12" executable:...

[SECURITY] Fedora 43 Update: python3.11-3.11.14-1.fc43

Python 3.11 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.11 package provides the "python3.11" executable:...

[SECURITY] Fedora 43 Update: dokuwiki-20250514b-1.fc43

DokuWiki is a standards compliant, simple to use Wiki, mainly aimed at creati ng documentation of any kind. It has a simple but powerful syntax which makes su re the data-files remain readable outside the Wiki and eases the creation of structured texts. All data is stored in plain text files no...