CVE-2025-56449

Obsidian Scheduler REST API 5.0.0–6.3.0 is affected. The root cause is that accounts locked out due to MFA enforcement can still authenticate via Basic Authentication for administrative actions, allowing creation of a new privileged user and bypassing MFA protections. The issue affects the REST A...

Avoid Using Programs Labeled unconfined_service_t

The purpose of setting the unconfinedservicet label for SELinux is to enable some third-party service processes not configured with SELinux policies to run without restrictions. By default, when systemd runs a third-party application whose label is bint or usrt generally located in directories su...

Police using drones to read your license plates, warns EFF

Police are using drones as flying automated license plate readers ALPRs, according to a report by the Electronic Frontier Foundation EFF. And where there is a market, a provider will jump in. Or was it the other way around this time? Flock Safety, for example, recently told a group of potential l...

Scammers are impersonating the FBI to steal your personal data

Been scammed? Hoping to report it to the FBI? Definitely do so, but be careful. Spoofed versions of the FBI's Internet Crime Complaint Center IC3 website are now circulating online, and they lead straight back to the scammers. The FBI issued an advisory last week, warning that cybercriminals are...

Dark Web Roast - August 2025 Edition

Dark Web Roast - August 2025 Edition By Trellix Advanced Research Center · September 18, 2025 Executive Summary August 2025 delivered a masterclass in cybercriminal incompetence that would make amateur hour look professional. From racist social engineering recruiters who prioritize race over actu...

Unspecified vulnerability in Apple macOS Tahoe (CNVD-2025-22390)

Apple macOS Tahoe is the 26th major release of Apple's macOS operating system, which was released on June 10, 2025, and features a new "Liquid Glass" visual design that significantly optimizes interface aesthetics, feature integration, and cross-device collaboration. The 26th major version of the...

CVE-2025-59270

The CVE-2025-59270 entry concerns the psPAS PowerShell module (Get-PASSAMLResponse) not explicitly enforcing TLS 1.2 during SAML authentication. The root cause is insufficient TLS protocol enforcement, enabling a MITM adversary in the handshake to downgrade TLS to a deprecated version. The vulner...

Improper Access Control

unopim/unopim is vulnerable to Improper Access Control. The vulnerability is due to insufficient privilege enforcement on the mass-delete endpoint, which allows an attacker without "Delete" permissions to bypass restrictions and delete products...

Jeffrey Epstein’s Yahoo Inbox Revealed

Plus: ICE deploys secretive phone surveillance tech, officials warn of Chinese surveillance tools in US highway infrastructure, and more...

Liferay Portal和Liferay DXP 安全漏洞

Liferay Portal and Liferay DXP are both products of Liferay, Inc.Liferay Portal is a J2EE based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP...

Apple iPhone Air and iPhone 17 Feature A19 Chips With Spyware-Resistant Memory Safety

Apple on Tuesday revealed a new security feature called Memory Integrity Enforcement MIE that's built into its newly introduced iPhone models, including iPhone 17 and iPhone Air. MIE, per the tech giant, offers "always-on memory safety protection" across critical attack surfaces such as the kerne...

Linux Distros Unpatched Vulnerability : CVE-2017-16852

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provider before 2.6.1 fails to properly configure itsel...

CVE-2025-58135

Improper action enforcement in certain Zoom Workplace Clients for Windows may allow an unauthenticated user to conduct a disclosure of information via network access...

CVE-2025-58135 Zoom Workplace Clients for Windows - Improper Action Enforcement

Improper action enforcement in certain Zoom Workplace Clients for Windows may allow an unauthenticated user to conduct a disclosure of information via network access...

CVE-2025-58135 Zoom Workplace Clients for Windows - Improper Action Enforcement

Improper action enforcement in certain Zoom Workplace Clients for Windows may allow an unauthenticated user to conduct a disclosure of information via network access...

Built-in Runtime Security for Containers

Security teams struggle with visibility into behaviors inside their running containers. Qualys is today announcing general availability of Container Runtime Security CRS to provide industry-leading visibility for running containers using an approach that is container-engine agnostic and layered...

PT-2025-36990

Name of the Vulnerable Software and Affected Versions: Zoom Workplace Clients for Windows affected versions not specified Description: Improper action enforcement in certain Zoom Workplace Clients for Windows may allow an unauthenticated user to conduct a disclosure of information via network...

CVE-2025-59033

The Microsoft vulnerable driver block list is implemented as Windows Defender Application Control WDAC policy. Entries that specify only the to-be-signed TBS part of the code signer certificate are properly blocked, but entries that specify the signing certificate's TBS hash along with a...

PT-2025-45518

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 140.0.7339.80 Description A flaw exists in Google Chrome's Devtools due to insufficient policy enforcement. This issue could allow a remote attacker to leak cross-origin data through the Devtools functionality...

CVE-2024-13065 Business Logic Error in Akinsoft's MyRezzta

Improper Enforcement of Behavioral Workflow, Uncontrolled Resource Consumption vulnerability in Akinsoft MyRezzta allows Input Data Manipulation, CAPEC - 125 - Flooding. This issue affects MyRezzta: from s2.02.02 before v2.05.01...