CVE-2025-64493

In SuiteCRM versions 8.6.0–8.9.0, an authenticated, blind (time-based) SQL injection exists in the appMetadata operation of the GraphQL API, allowing extraction of arbitrary data without admin access. Affected component: GraphQL API, operation appMetadata. Root cause: improper handling/validation...

[SECURITY] Fedora 43 Update: luksmeta-10-1.fc43

LUKSMeta is a command line utility for storing small portions of metadata in the LUKSv1 header for use before unlocking the volume...

Fedora 43 : luksmeta (2025-e53e8fdc0a)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-e53e8fdc0a advisory. Fix handling of large metadata Fix: CVE-2025-11568 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note tha...

Faking Receipts with AI

Over the past few decades, it's become easier and easier to create fake receipts. Decades ago, it required special paper and printers--I remember a company in the UK advertising its services to people trying to cover up their affairs. Then, receipts became computerized, and faking them required...

CVE-2025-64180

Manager-io/Manager is accounting software. In Manager Desktop and Server versions 25.11.1.3085 and below, a critical vulnerability permits unauthorized access to internal network resources. The flaw lies in the fundamental design of the DNS validation mechanism. A Time-of-Check Time-of-Use TOCTOU...

The vulnerability of the jpegBase::readMetadata() function in the library and the command-line utility for managing image metadata from Exiv2 allows a attacker to cause a service failure.

The vulnerability of the jpegBase::readMetadata function in the Exiv2 library and command-line utilities for managing image metadata involves inefficient algorithmic complexity. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

CVE-2025-12815

An ownership verification issue in the Virtual Desktop preview page in the Research and Engineering Studio RES on AWS before version 2025.09 may allow an authenticated remote user to view another user's active desktop session metadata, including periodical desktop preview screenshots. To mitigate...

EUVD-2025-38148

An ownership verification issue in the Virtual Desktop preview page in the Research and Engineering Studio RES on AWS before version 2025.09 may allow an authenticated remote user to view another user's active desktop session metadata, including periodical desktop preview screenshots. To mitigate...

CVE-2025-12815

An ownership verification issue in the Virtual Desktop preview page in the Research and Engineering Studio RES on AWS before version 2025.09 may allow an authenticated remote user to view another user's active desktop session metadata, including periodical desktop preview screenshots. To mitigate...

libtiff: Libtiff Write-What-Where

A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file. By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controll...

PT-2025-45526

Name of the Vulnerable Software and Affected Versions SuiteCRM versions 8.6.0 through 8.9.0 Description SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Versions 8.6.0 through 8.9.0 are susceptible to an authenticated, blind time-based...

PT-2025-45343

Name of the Vulnerable Software and Affected Versions AWS Research and Engineering Studio versions prior to 2025.09 Description An ownership verification issue exists in the Virtual Desktop preview page within the Research and Engineering Studio RES on AWS. This issue may allow a user with networ...

Amazon Web Services Research and Engineering Studio 安全漏洞

Amazon Web Services Research and Engineering Studio is a cloud-based research and engineering environment from Amazon USA Inc. A security vulnerability exists in Amazon Web Services Research and Engineering Studio versions prior to 2025.09, which stems from an ownership authentication issue that...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-989542)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989542 advisory. In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix deadlock in nilfscountfreeblocks A semaphore deadlock can occur if nilfsgetblock...

SUSE SLED15: aws-cli / python311-boto3 / python311-botocore / python311-coverage / etc (SUSE-SU-2025:3744-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:3744-1 advisory. Changes in aws-cli: - Update to 1.33.26 api-change:acm-pca: Minor refactoring of C2J model for A...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988822)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988822 advisory. In the Linux kernel, the following vulnerability has been resolved: net: fix a memleak when uncloning an skb dst and its metadata When uncloning an skb dst and its...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990038)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990038 advisory. In the Linux kernel, the following vulnerability has been resolved: md/raid5: avoid BUGON while continue reshape after reassembling Currently, mdadm support...

Whisper Leak: A Side-Channel Attack on Large Language Models

Large Language Models LLMs are increasingly deployed in sensitive domains including healthcare, legal services, and confidential communications, where privacy is paramount. This paper introduces Whisper Leak, a side-channel attack that infers user prompt topics from encrypted LLM traffic by...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989377)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989377 advisory. In the Linux kernel, the following vulnerability has been resolved: net/packet: fix slab-out-of-bounds access in packetrecvmsg syzbot found that when an AFPACKET...

Missing Authentication

Overview Affected versions of this package are vulnerable to Missing Authentication in the xDS interface. An attacker can access sensitive configuration data, including certificate information, backend service details, routing rules, and cluster metadata, by connecting to the exposed port without...