Linux Distros Unpatched Vulnerability : CVE-2023-47039

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was found in Perl. This security issue occurs while Perl for Windows relies on the system path environment variable to find the shell cmd.exe...

CKM-Assisted Physical-Layer Security for Resilience against Unknown Eavesdropping Location

Channel Knowledge Map CKM is an emerging data-driven toolbox that captures our awareness of the wireless channel and enables efficient communication and resource allocation beyond the state of the art. In this work, we consider CKM for improving physical-layer security PLS in the presence of a...

Instagram Map: What is it and how do I control it?

Instagram Map is a new feature—for Instagram, anyway—that users may have enabled without being fully aware of the consequences. The Map feature launched in the US on August 6, 2025, and is reportedly planned for a global rollout "soon." As of mid-August 2025, not all users outside the US,...

Linux Distros Unpatched Vulnerability : CVE-2025-1861

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In PHP from 8.1. before 8.1.32, from 8.2. before 8.2.28, from 8.3. before 8.3.19, from 8.4. before 8.4.5, when parsing HTTP redirect in the response to an HTTP...

Huawei HarmonyOS Cross-Border Access Vulnerability

Huawei HarmonyOS is Huawei's self-developed distributed operating system for all scenarios. Huawei HarmonyOS suffers from an out-of-bounds access vulnerability, which is due to insufficient data validation in the location services module, and can be exploited by an attacker to affect availability...

Huawei HarmonyOS Type Obfuscation Vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. Huawei HarmonyOS suffers from a type confusion vulnerability that can be exploited by an attacker to cause location information attribute errors...

Friday Squid Blogging: Squid-Shaped UFO Spotted Over Texas

Here's the story. The commenters on X formerly Twitter are unimpressed. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Blog moderation policy...

Linux Distros Unpatched Vulnerability : CVE-2019-5108

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerability by triggering AP t...

CVE-2025-40746

SIMATIC RTLS Locating Manager (versions prior to V3.2) contains an input validation issue in the backup script path that can be exploited by an authenticated remote attacker with high privileges to execute arbitrary code with SYSTEM privileges. Multiple connected sources (Red Hat CVE page, NVD en...

Load-Altering Attacks against Power Grids: a Case Study Using the GB-36 Bus System Open Dataset

The growing digitalization and the rapid adoption of high-powered Internet-of-Things IoT-enabled devices e.g., EV charging stations have increased the vulnerability of power grids to cyber threats. In particular, the so-called Load Altering Attacks LAAs can trigger rapid frequency fluctuations an...

Siemens SIMATIC RTLS Locating Manager

SUMMARY SIMATIC RTLS Locating Manager Before V3.2 contains an improper input validation vulnerability that could allow an authenticated remote attacker to execute arbitrary code with high privileges. Siemens has released a new version for SIMATIC RTLS Locating Manager and recommends to update to...

BIT-LIBPHP-2025-1861 Stream HTTP wrapper truncates redirect location to 1024 bytes

In PHP from 8.1. before 8.1.32, from 8.2. before 8.2.28, from 8.3. before 8.3.19, from 8.4. before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC911...

BIT-LIBPYTHON-2022-45061

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA RFC 3490 decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often...

CVE-2025-7020

An incorrect encryption implementation vulnerability exists in the system log dump feature of BYD's DiLink 3.0 OS e.g. in the model ATTO3. An attacker with physical access to the vehicle can bypass the encryption of log dumps on the In-Vehicle Infotainment IVI unit's storage. This allows the...

Linux Distros Unpatched Vulnerability : CVE-2025-21985

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amd/display: Fix out-of-bound accesses WHAT & HOW hpostreamtolinkencodermapping has size MAXHPODP2ENCODERS=4, but location can have size up to 6. As a resul...

Linux Distros Unpatched Vulnerability : CVE-2020-26963

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Repeated calls to the history and location interfaces could have been used to hang the browser. This was addressed by introducing rate-limiting to these API...

CVE-2025-54793

Astro is a web framework for content-driven websites. In versions 5.2.0 through 5.12.7, there is an Open Redirect vulnerability in the trailing slash redirection logic when handling paths with double slashes. This allows an attacker to redirect users to arbitrary external domains by crafting URLs...

Linux Distros Unpatched Vulnerability : CVE-2021-43545

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Using the Location API in a loop could have caused severe application hangs and crashes. This vulnerability affects Thunderbird 91.4.0, Firefox ESR 91.4.0, and...

CVE-2025-7020

An incorrect encryption implementation vulnerability exists in the system log dump feature of BYD's DiLink 3.0 OS e.g. in the model ATTO3. An attacker with physical access to the vehicle can bypass the encryption of log dumps on the In-Vehicle Infotainment IVI unit's storage. This allows the...

CVE-2025-7020 BYD DiLink OS Incorrect encryption Implementation of system log dumps

An incorrect encryption implementation vulnerability exists in the system log dump feature of BYD's DiLink 3.0 OS e.g. in the model ATTO3. An attacker with physical access to the vehicle can bypass the encryption of log dumps on the In-Vehicle Infotainment IVI unit's storage. This allows the...