CVE-2025-6238 AI Engine 2.8.4 - Insecure OAuth Implementation

The AI Engine plugin for WordPress is vulnerable to open redirect in version 2.8.4. This is due to an insecure OAuth implementation, as the 'redirecturi' parameter is missing validation during the authorization flow. This makes it possible for unauthenticated attackers to intercept the...

AI Dilemma: Emerging Tech as Cyber Risk Escalates

As AI adoption accelerates, businesses face mounting cyber threats—and urgent choices about secure implementation...

Security Bulletin:Unclear documentation of the error behavior in `ParseWithClaims` affects watsonx.data

Summary golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by...

CVE-2025-41647

A local, low-privileged attacker can learn the password of the connected controller in PLC Designer V4 due to an incorrect implementation that results in the password being displayed in plain text under special conditions...

hosporder 注入漏洞

hosporder is a hospital appointment registration system by the individual developer Xiaohao.Shi in China. There is an injection vulnerability in hosporder, which originates from a SQL injection due to the incorrect operation of the parameter hospitalName in the file DoctorServiceImpl.java...

Why We Chose Rust For Spin

When Fermyon set out to implement Spin, the decision to use Rust wasn't just logical — it felt inevitable...

CVE-2025-2962

A denial-of-service issue in the dns implemenation could cause an infinite loop...

CVE-2025-5823 Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerability

Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is...

[SECURITY] Fedora 41 Update: mirrorlist-server-3.0.7-7.fc41

The mirrorlist-server uses the data created by MirrorManager2 https://github.com/fedora-infra/mirrormanager2 to answer client request for the "best" mirror. This implementation of the mirrorlist-server is written in Rust. The original version of the mirrorlist-server was part of the MirrorManager...

[SECURITY] Fedora 42 Update: mirrorlist-server-3.0.7-7.fc42

The mirrorlist-server uses the data created by MirrorManager2 https://github.com/fedora-infra/mirrormanager2 to answer client request for the "best" mirror. This implementation of the mirrorlist-server is written in Rust. The original version of the mirrorlist-server was part of the MirrorManager...

CVE-2025-52566

A flaw was found in the tokenizer component of llama.cpp. This vulnerability allows heap memory corruption via carefully crafted text input during tokenization, due to a signed vs. unsigned integer overflow in the llamavocab::tokenize function. Mitigation Mitigation for this issue is either not...

CVE-2025-2962

A denial-of-service issue in the dns implemenation could cause an infinite loop...

CVE-2025-2962

CVE-2025-2962 affects Zephyr RTOS (Zephyr project)

CVE-2025-2962 Infinite loop in dns_copy_qname

A denial-of-service issue in the dns implemenation could cause an infinite loop...

CVE-2025-52566

llama.cpp is an inference of several LLM models in C/C++. Prior to version b5721, there is a signed vs. unsigned integer overflow in llama.cpp's tokenizer implementation llamavocab::tokenize src/llama-vocab.cpp:3036 resulting in unintended behavior in tokens copying size comparison. Allowing...

CVE-2025-52566 llama.cpp tokenizer signed vs. unsigned heap overflow

llama.cpp is an inference of several LLM models in C/C++. Prior to version b5721, there is a signed vs. unsigned integer overflow in llama.cpp's tokenizer implementation llamavocab::tokenize src/llama-vocab.cpp:3036 resulting in unintended behavior in tokens copying size comparison. Allowing...

PT-2025-26697 · Zephyrproject Rtos · Zephyr

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: A denial-of-service issue in the dns implementation could cause an infinite loop. Recommendations: At the moment, there is no information about a newer version that contains a fix for this...

How AI-Enabled Workflow Automation Can Help SOCs Reduce Burnout

It sure is a hard time to be a SOC analyst. Every day, they are expected to solve high-consequence problems with half the data and twice the pressure. Analysts are overwhelmed—not just by threats, but by the systems and processes in place that are meant to help them respond. Tooling is fragmented...

CVE-2025-49715

Exposure of private personal information to an unauthorized actor in Dynamics 365 FastTrack Implementation Assets allows an unauthorized attacker to disclose information over a network...

ALSA-2025:9329 Important: perl-YAML-LibYAML security update

Kirill Siminov's "libyaml" is arguably the best YAML implementation. The C library is written precisely to the YAML 1.1 specification. It was originally bound to Python and was later bound to Ruby. Security Fixes: yaml-libyaml: LibYAML Perl File Modification Vulnerability CVE-2025-40908 For more...