CVE-2025-54884

CVE-2025-54884 applies to Vision UI 1.4.0 and below, where security-kit pre-3.5.0 functions generateSecureId and getSecureRandomInt can trigger memory exhaustion under DoS scenarios. Specifically, generateSecureId(length) uses length to size a Uint8Array, enabling excessive memory allocation via ...

Selection-Based Vulnerabilities: Clean-Label Backdoor Attacks in Active Learning

Active learningAL, which serves as the representative label-efficient learning paradigm, has been widely applied in resource-constrained scenarios. The achievement of AL is attributed to acquisition functions, which are designed for identifying the most important data to label. Despite this...

glibc security update

2.28-251.0.3.25 - Forward port of Oracle patches Reviewed-by: Jose E. Marchesi Oracle history: June-9-2025 Cupertino Miranda - 2.28-251.0.3.22 - Forward port of Oracle patches Reviewed-by: David Faust April-14-2025 Cupertino Miranda - 2.28-251.0.3.16 - Forward port of Oracle patches Reviewed-by:...

The vulnerability of the SUSE Manager, a tool for centralized management of IT infrastructure, relates to the lack of authentication for critical functions. This allows attackers to execute arbitrary commands with root privileges.

The vulnerability of the SUSE Manager, a tool for centralized management of IT infrastructure, is related to the lack of authentication for critical functions. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands with root privileges remotely...

CLSA-2025-1753982448 php: Fix of CVE-2025-1735

CVE-2025-1735: add error checking for pgsql extension escape functions, mainly to fix possible issues with multi-byte encoding of Postgres databases...

libxslt: libxml2: Heap Use-After-Free in libxslt caused by atype corruption in xmlAttrPtr

A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may acce...

CLSA-2025-1753953101 php: Fix of CVE-2025-1735

CVE-2025-1735: add error checking for pgsql extension escape functions, mainly to fix possible issues with multi-byte encoding of Postgres databases...

CVE-2025-8322

The e-School from Ventem has a Missing Authorization vulnerability, allowing remote attackers with regular privilege to access administrator functions, including creating, modifying, and deleting accounts. They can even escalate any account to system administrator privilege...

PT-2025-31374 · E-School · E-School

Name of the Vulnerable Software and Affected Versions: e-School affected versions not specified Description: The e-School system contains a missing authorization flaw. This allows remote attackers with regular privileges to access administrator functions, including creating, modifying, and deleti...

SUSE Manager 访问控制错误漏洞

SUSE Manager is a Linux server management system from SUSE Germany. The system provides automated software management, system configuration and monitoring. An access control error vulnerability exists in SUSE Manager that stems from a lack of authentication for critical functions and could lead t...

CVE-2025-53077

An execution after redirect in Samsung DMSData Management Server allows attackers to execute limited functions without permissions. An attacker could compromise the integrity of the platform by executing this vulnerability...

CVE-2025-53077

An execution after redirect in Samsung DMSData Management Server allows attackers to execute limited functions without permissions. An attacker could compromise the integrity of the platform by executing this vulnerability...

CVE-2025-30126

CVE-2025-30126 concerns Marbella KR8s Dashcam FF 2.0.8. The vulnerability allows a remote attacker to access port 7777 without pairing or physical interaction and modify settings to disable recording, delete recordings, or disable battery protection, which can lead to a flat battery and the car b...

Building a GraphQL API with Fermyon Wasm Functions

Use this step-by-step guide to create a serverless GraphQL client that fetches GitHub repository stargazer data using Rust, WebAssembly, and Fermyon Wasm Functions...

CVE-2025-38462 vsock: Fix transport_{g2h,h2g} TOCTOU

In the Linux kernel, the following vulnerability has been resolved: vsock: Fix transportg2h,h2g TOCTOU vsockfindcid and vsockdevdoioctl may race with module unload. transportg2h,h2g may become NULL after the NULL check. Introduce vsocktransportlocalcid to protect from a potential null-ptr-deref...

CVE-2025-38362 drm/amd/display: Add null pointer check for get_first_active_display()

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add null pointer check for getfirstactivedisplay The function modhdcphdcp1enableencryption calls the function getfirstactivedisplay, but does not check its return value. The return value is a null pointer if the...

DEBIAN-CVE-2025-8114

A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange KEX process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to crash...

CVE-2025-8114 Libssh: null pointer dereference in libssh kex session id calculation

A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange KEX process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to crash...

CVE-2025-8114

A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange KEX process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to crash...

Medtronic MyCareLink Patient Monitor 安全漏洞

Medtronic MyCareLink Patient Monitor is an open source monitoring system for remote patient monitoring from Medtronic in the United States. A security vulnerability exists in Medtronic MyCareLink Patient Monitor versions prior to 2025.6.25, which stems from the use of an empty password for the...