CVE-2025-31124: Observable Discrepancy

Zitadel is open-source identity infrastructure software. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. If enabled, ZITADEL will show the password prompt even if the user doesn't exist and report...

USN-7387-3: Linux kernel (Real-time) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - MIPS architecture; - PowerPC architecture; - RISC-V architecture; - S390 architecture; - Supe...

Researchers Uncover 46 Critical Flaws in Solar Power Systems From Sungrow, Growatt, and SMA

Cybersecurity researchers have disclosed 46 new security flaws in products from three solar power system vendors, Sungrow, Growatt, and SMA, that could be exploited by a bad actor to seize control of devices or execute code remotely, posing severe risks to electrical grids. The vulnerabilities ha...

Ubuntu 24.10 : Linux kernel (Low Latency) vulnerabilities (USN-7380-1)

"The remote Ubuntu 24.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7380-1 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in th...

USN-7387-1 linux, linux-aws, linux-azure, linux-gcp, linux-gke, linux-gkeop, linux-ibm, linux-intel-iotg, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15, linux-raspi vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - MIPS architecture; - PowerPC architecture; - RISC-V architecture; - S390 architecture; - Supe...

USN-7382-1: Linux kernel (OEM) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - MIPS architecture; - PowerPC architecture; - RISC-V architecture; - S390 architecture; - x86...

USN-7380-1 linux-lowlatency vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - MIPS architecture; - PowerPC architecture; - RISC-V architecture; - S390 architecture; - x86...

USN-7379-1 linux, linux-aws, linux-azure, linux-gcp, linux-hwe-6.11, linux-oracle, linux-realtime vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - MIPS architecture; - PowerPC architecture; - RISC-V architecture; - S390 architecture; - x86...

About Remote Code Execution – Veeam Backup & Replication (CVE-2025-23120) vulnerability

About Remote Code Execution - Veeam Backup & Replication CVE-2025-23120 vulnerability. Veeam B&R is a client-server software solution for centralized backup of virtual machines in VMware vSphere and Microsoft Hyper-V environments. A deserialization flaw CWE-502 lets an attacker run arbitrary code...

Report on Paragon Spyware

Citizen Lab has a new report on Paragon's spyware: Key Findings: Introducing Paragon Solutions. Paragon Solutions was founded in Israel in 2019 and sells spyware called Graphite. The company differentiates itself by claiming it has safeguards to prevent the kinds of spyware abuses that NSO Group...

Ansible vs Terraform: Which is More Secure for Infrastructure Automation?

Gartner describes infrastructure as code IaC as a key way to unlock the potential of the cloud. However,…...

UAT-5918 Targets Taiwan's Critical Infrastructure Using Web Shells and Open-Source Tools

Threat hunters have uncovered a new threat actor named UAT-5918 that has been attacking critical infrastructure entities in Taiwan since at least 2023. "UAT-5918, a threat actor believed to be motivated by establishing long-term access for information theft, uses a combination of web shells and...

The vulnerability of the `nvkm_client_new()` function in the `drivers/gpu/drm/nouveau/nvkm/core/client.c` file of the Nouveau driver module allows a hacker to cause a service failure. This vulnerability relates to the Direct Rendering Infrastructure (DRI) support in NVIDIA’s Linux kernel-based graphics drivers.

The vulnerability of the nvkmclientnew function in the drivers/gpu/drm/nouveau/nvkm/core/client.c file of the Nouveau driver, a driver for supporting Direct Rendering Infrastructure DRI in NVIDIA graphics cards and Linux operating systems, is related to improper resource locking. Exploiting this...

The vulnerability of the dcn20_get_dcc_compression_cap() function in the drivers/gpu/drm/amd/display/dc/resource/dcn20/dcn20_resource.c driver module allows a malicious actor to trigger a service failure. This vulnerability exists in the Linux operating system’s AMD GPU Direct Rendering Infrastructure (DRI) support driver.

The vulnerability of the dcn20getdcccompressioncap function in the drivers/gpu/drm/amd/display/dc/resource/dcn20/dcn20resource.c driver is related to the assignment of the NULL pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the resource_log_pipe_topology_update() function in the drivers/gpu/drm/amd/display/dc/core/dc_resource.c file of the DRI support driver for AMD graphics cards in Linux operating systems allows a malicious actor to cause a service failure.

The vulnerability of the resourcelogpipetopologyupdate function in the drivers/gpu/drm/amd/display/dc/core/dcresource.c file, a driver for AMD Direct Rendering Infrastructure DRI graphics cards in Linux operating systems, relates to pointer manipulation. Exploiting this vulnerability could allow ...

UAT-5918 targets critical infrastructure entities in Taiwan

By Jung soo An, Asheer Malhotra, Brandon White, and Vitor Ventura. Cisco Talos discovered a malicious campaign we track under the UAT-5918 umbrella that has been active since at least 2023. UAT-5918, a threat actor believed to be motivated by establishing long-term access for information theft,...

GHSA-265R-HFXG-FHMG vulnerabilities

Vulnerabilities for packages: cilium-cli, k8sgpt, opa, k3s, zot, docker-compose, newrelic-infrastructure-agent, kaniko, kargo, melange, eksctl, chartmuseum, flux-source-controller, kubescape, helm, cluster-api-helm-controller, kubevela, cert-manager-cmctl, dagger, grype, linkerd2,...

The vulnerability of the amdgpu_dm_fini() function in the drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c driver module allows a hacker to cause a service failure in Linux-based AMD graphics cards that support Direct Rendering Infrastructure (DRI).

The vulnerability of the amdgpudmfini function in the drivers/gpu/drm/amd/display/amdgpudm/amdgpudm.c driver module is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2024-7267

Exposure of Sensitive Information vulnerability in Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy EZD RP allows logged-in user to retrieve information about IP infrastructure and credentials. This issue affects EZD RP all versions before 19.6...

The vulnerability of the drm_dp_mst_up_req_work() function in the driver drivers/gpu/drm/display/drm_dp_mst_topology.c, which supports the Direct Rendering Infrastructure (DRI) of the Linux operating system’s kernel, allows a hacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the drmdpmstupreqwork function in the driver drivers/gpu/drm/display/drmdpmsttopology.c, which is part of the Direct Rendering Infrastructure DRI support for the Linux kernel, relates to the assignment of the NULL pointer. Exploiting this vulnerability could allow an attacker...