537 matches found
SUSE-SU-2026:20941-1 Security update for ucode-intel
This update for ucode-intel fixes the following issues: - Intel CPU Microcode was updated to the 20260210 release bsc1258046: - CVE-2024-24853: Updated fix for incorrect behavior order in transition between executive monitor and SMI transfer monitor STM in some IntelR Processor may allow a...
SUSE-SU-2026:20758-1 Security update for ucode-intel
This update for ucode-intel fixes the following issues: - Intel CPU Microcode was updated to the 20260210 release bsc1258046: - CVE-2024-24853: Updated fix for incorrect behavior order in transition between executive monitor and SMI transfer monitor STM in some IntelR Processor may allow a...
How to Prioritize Vulnerabilities Effectively: A Framework
Attackers don’t care about your massive backlog of "critical" vulnerabilities. They look for the path of least resistance—the one exploitable weakness that gives them a foothold into your network. If your vulnerability management program isn't thinking like an attacker, you're always one step...
Security-By-Design for LLM-Based Code Generation: Leveraging Internal Representations for Concept-Driven Steering Mechanisms
Large Language Models LLMs show remarkable capabilities in understanding natural language and generating complex code. However, as practitioners adopt CodeLLMs for increasingly critical development tasks, research reveals that these models frequently generate functionally correct yet insecure cod...
Microsoft SDL: Evolving security practices for an AI-powered world
As AI reshapes the world, organizations encounter unprecedented risks, and security leaders take on new responsibilities. Microsoft’s Secure Development Lifecycle SDL is expanding to address AI-specific security concerns in addition to the traditional software security areas that it has...
Microsoft SDL: Evolving security practices for an AI-powered world
As AI reshapes the world, organizations encounter unprecedented risks, and security leaders take on new responsibilities. Microsoft’s Secure Development Lifecycle SDL is expanding to address AI-specific security concerns in addition to the traditional software security areas that it has...
The Semantic Trap: Do Fine-Tuned LLMs Learn Vulnerability Root Cause or Just Functional Pattern?
LLMs demonstrate promising performance in software vulnerability detection after fine-tuning. However, it remains unclear whether these gains reflect a genuine understanding of vulnerability root causes or merely an exploitation of functional patterns. In this paper, we identify a critical failur...
Infinite Loop Denial of Service via Circular Dependencies in Functional Model Deserialization
Description A vulnerability in keras.src.models.functional.functionalfromconfig allows a Denial of Service DoS attack via an infinite loop. When reconstructing a Functional model from a configuration e.g., via keras.models.loadmodel, the deserialization logic fails to detect or break out of...
On the Impossibility of Simulation Security for Quantum Functional Encryption
Functional encryption is a powerful cryptographic primitive that enables fine-grained access to encrypted data and underlies numerous applications. Although the ideal security notion for FE simulation security has been shown to be impossible in the classical setting, those impossibility results...
Linux Kernel Security Vulnerabilities
The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which can lead to denial-of-service attacks and functional failures due to recursive forward correction...
CVE-2025-1031
Authorization Bypass Through User-Controlled Key vulnerability in Utarit Informatics Services Inc. SoliClub allows Functionality Misuse.This issue affects SoliClub: from 5.2.4 before 5.3.7...
The vulnerability of the RDBMS Functional Index component of the Oracle Database Server allows a hacker to gain read access to data.
The vulnerability of the RDBMS Functional Index component in the Oracle Database Server management system is related to the violation of the buffer’s initial limit. Exploiting this vulnerability can allow an attacker, operating remotely, to gain read access to data...
SUSE CVE-2022-50669
In the Linux kernel, the following vulnerability has been resolved: misc: ocxl: fix possible name leak in ocxlfileregisterafu If deviceregister returns error in ocxlfileregisterafu, the name allocated by devsetname need be freed. As comment of deviceregister says, it should use putdevice to give ...
ReFuzz: Reusing Tests for Processor Fuzzing with Contextual Bandits
Processor designs rely on iterative modifications and reuse well-established designs. However, this reuse of prior designs also leads to similar vulnerabilities across multiple processors. As processors grow increasingly complex with iterative modifications, efficiently detecting vulnerabilities...
Huawei HarmonyOS Security Checks for Improper Standards Vulnerability
Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. Huawei HarmonyOS suffers from an Improper Security Check Criteria vulnerability that originates from an improper security check criterion for the call module...
What Is Exposure Management? A Proactive Guide
Attackers don’t see your organization as a list of CVEs. They see a web of interconnected systems, looking for the path of least resistance to their target. They find one small weakness, then another, and chain them together to create a breach. So why would we defend our networks any differently?...
CVE-2025-37156 ArubaOS-CX Platform-Level Denial-of-Service Vulnerability
A platform-level denial-of-service DoS vulnerability exists in ArubaOS-CX software. Successful exploitation of this vulnerability could allow an attacker with administrative access to execute specific code that renders the switch non-bootable and effectively non-functional...
EUVD-2025-117360
Malicious code in functional-white-bonobo npm...
Taught by the Flawed: How Dataset Insecurity Breeds Vulnerable AI Code
AI programming assistants have demonstrated a tendency to generate code containing basic security vulnerabilities. While developers are ultimately responsible for validating and reviewing such outputs, improving the inherent quality of these generated code snippets remains essential. A key...