ASB-A-417987184

In verifyAndGetBypass of AppOpsService.java, there is a possible method for a malicious app to prevent dialing emergency services under limited circumstances due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is...

Millions at risk after nationwide CodeRED alert system outage and data breach

A nationwide cyberattack against the OnSolve CodeRED emergency notifications system has prompted cities and counties across the US to warn residents and advise them to change their passwords. CodeRED is used by local governments to deliver fast, targeted alerts during severe weather, evacuations,...

SiRcom SMART Alert (SiSA)

RISK EVALUATION Successful exploitation of this vulnerability could enable an attacker to remotely activate or manipulate emergency sirens. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network...

SAP Pushes Emergency Patch for 9.9 Rated CVE-2025-42887 After Full Takeover Risk

CVE 2025 42887 vulnerability, rated 9.9, allows code injection through Solution Manager giving attackers full SAP control urgent patch needed to block system takeover...

Update: Implementation Guidance for Emergency Directive on Cisco ASA and Firepower Device Vulnerabilities

CISA has released Emergency Cisco Directive 25-03 Implementation Guidance to assist federal agencies in addressing critical vulnerabilities in Cisco Adaptive Security Appliances ASA and Firepower devices. Emergency Directive 25-03: Identify and Mitigate Potential Compromise of Cisco Devices, issu...

PT-2025-46139

Name of the Vulnerable Software and Affected Versions Malware Remover versions prior to 6.6.8.20251023 Description Improper control of code generation allows remote attackers to perform code injection, leading to remote code execution and the ability to bypass protection mechanisms. Recommendatio...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988694)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988694 advisory. In the Linux kernel, the following vulnerability has been resolved: powerpc/64s: fix program check interrupt emergency stack path Emergency stack path was jumping in...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989914)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989914 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: Fix stack handling in idlekvmstartguest In commit 10d91611f426 powerpc/64s:...

Would you sext ChatGPT? (Lock and Code S06E22)

This week on the Lock and Code podcast … In the final, cold winter months of the year, ChatGPT could be heating up. On October 14, OpenAI CEO Sam Altman said that the "restrictions" that his company previously placed on their flagship product, ChatGPT, would be removed, allowing, perhaps, for...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: configfs-tsm-report: Fixed the NULL dereference of tsmops. Unlike sysfs, the lifetime of configfs objects is controlled by userspace. There is no mechanism for the kernel to find and delete all created config-items. Instead, t...

Phishing scam uses fake death notices to trick LastPass users

LastPass has alerted users about a new phishing attack that claims the recipient has died. According to the message, a family member has submitted a death certificate to gain access to the recipient’s password vault. A link in the phishing email, supposedly to stop the request, leads to a fake pa...

Newly Patched Critical Microsoft WSUS Flaw Comes Under Active Exploitation

Microsoft on Thursday released out-of-band security updates to patch a critical-severity Windows Server Update Services WSUS vulnerability with a proof-of-concept Poc exploit publicly available and has come under active exploitation in the wild. The vulnerability in question is CVE-2025-59287 CVS...

PT-2025-43478

In verifyAndGetBypass of AppOpsService.java, there is a possible method for a malicious app to prevent dialing emergency services under limited circumstances due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987588)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987588 advisory. In the Linux kernel, the following vulnerability has been resolved: powerpc/64s: fix program check interrupt emergency stack path Emergency stack path was jumping in...

CERTFR-2025-ACT-043

creationtimestamp| type| source ---|---|--- 2025-10-13 12:13:08+00:00| seen| https://bsky.app/profile/cert-fr.bsky.social/post/3m336sfepqs2y 2025-10-13 12:13:12+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/115366794855854060 2025-10-13 12:33:02+00:00| seen|...

EUVD-2025-32708

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Callvision Healthcare Callvision Emergency Code allows SQL Injection, Blind SQL Injection.This issue affects Callvision Emergency Code: before V3.0...

CVE-2025-0603

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Callvision Healthcare Callvision Emergency Code allows SQL Injection, Blind SQL Injection. This issue affects Callvision Emergency Code: before V3.0...

CVE-2025-0603 SQLi in Callvision Healthcare's Callvision Emergency Code

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Callvision Healthcare Callvision Emergency Code allows SQL Injection, Blind SQL Injection. This issue affects Callvision Emergency Code: before V3.0...

CVE-2025-0603

The CVE-2025-0603 issue is an SQL injection vulnerability in Callvision Healthcare’s Callvision Emergency Code, caused by improper neutralization of special elements in SQL commands. Affects Callvision Emergency Code versions before V3.0. Impact is high across confidentiality, integrity, and avai...

CVE-2025-0603

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Callvision Healthcare Callvision Emergency Code allows SQL Injection, Blind SQL Injection. This issue affects Callvision Emergency Code: before V3.0...