[SECURITY] Fedora 41 Update: chromium-138.0.7204.183-1.fc41

Chromium is an open-source web browser, powered by WebKit Blink...

[SECURITY] Fedora 42 Update: firefox-141.0.2-1.fc42

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

executorch security vulnerability

executorch is an open source PyTorch deployment tool for PyTorch by pytorch. A security vulnerability exists in executorch that stems from a heap buffer overflow when loading a model, which could lead to code execution...

CBL Mariner 2.0 Security Update: vim (CVE-2025-53906)

The version of vim installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-53906 advisory. - Vim is an open source, command line text editor. Prior to version 9.1.1551, a path traversal issue in Vim's...

PRvL: Quantifying the Capabilities and Risks of Large Language Models for PII Redaction

Redacting Personally Identifiable Information PII from unstructured text is critical for ensuring data privacy in regulated domains. While earlier approaches have relied on rule-based systems and domain-specific Named Entity Recognition NER models, these methods fail to generalize across formats...

JWT security vulnerability

jwt is a Ruby library for JSON Web Token open source. A security vulnerability exists in jwt version v3.0.0.beta1, which stems from the presence of a weak cryptographic implementation...

executorch security vulnerability

executorch is an open source PyTorch deployment tool for PyTorch by pytorch. A security vulnerability exists in executorch that stems from multiple buffer overflows when loading a model, which could lead to a crash or code execution...

Himmelblau security vulnerability

Himmelblau is an Azure Entra ID authentication module open-sourced by Himmelblau. A security vulnerability exists in Himmelblau versions 0.8.0 through 0.9.21 and 1.0.0-beta through 1.1.0, which stems from the Cloud TGT credential cache being stored as globally readable...

executorch security vulnerability

executorch is an open source PyTorch deployment tool for PyTorch by pytorch. A security vulnerability exists in executorch that stems from an integer overflow that causes an object to be allocated to the wrong memory region, which could lead to the execution of arbitrary code...

NVIDIA Triton Inference Server security vulnerabilities

NVIDIA Triton Inference Server is an open source software from NVIDIA that helps standardize model deployment and deliver fast and scalable AI in production. A denial of service vulnerability exists in NVIDIA Triton Inference Server, which can be exploited by attackers to cause segmentation error...

Janssen security vulnerabilities

Janssen is an open source user authentication component from the Janssen Project open source. A security vulnerability exists in Janssen 1.9.0 and earlier versions, which stems from passwords being stored in plaintext in log files...

CVE-2025-54571 ModSecurity's Insufficient Return Value Handling can Lead to XSS and Source Code Disclosure

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. For example, we have demonstrate...

U.S. Dept Of Defense: CVE‑2025‑4123 — Grafana Open Redirect → Stored XSS → SSRF (Full Read) at ██████

A vulnerability, identified as CVE-2025-4123, was discovered in Grafana OSS and Enterprise versions 8.x through 12.x. The vulnerability allowed unauthenticated attackers to chain multiple flaws, including an open redirect through path traversal in the public redirect handler, stored cross-site...

Open Source & Fully Managed: Aiven-Powered Databases on Akamai

...

CVE-2025-53544 Trilium Notes is Vulnerable to Brute-force Protection Bypass via Initial Sync Seed Retrieval

Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases. In versions below 0.97.0, a brute-force protection bypass in the initial sync seed retrieval endpoint allows unauthenticated attackers to guess the login...

PT-2025-31882 · Unknown · Trilium Notes

Name of the Vulnerable Software and Affected Versions: Trilium Notes versions prior to 0.97.0 Description: Trilium Notes is a cross-platform hierarchical note taking application. A brute-force protection bypass in the initial sync seed retrieval endpoint allows unauthenticated attackers to guess...

Narcissus security vulnerabilities

narcissus is an online image assembler open-sourced by The Angstrom Distribution. A security vulnerability exists in Narcissus that stems from an uncleared release parameter that could lead to remote command execution...

NanoVault security vulnerabilities

NanoVault is an open source wallet software using Nano cryptocurrency by Andrew Steele, an individual developer. A security vulnerability exists in NanoVault 1.2.1 and earlier versions, which stems from a cross-site scripting vulnerability in the function executeJavaScript in file/main.js...

Google Chrome security vulnerabilities

Google Chrome is a web browser from Google, Inc. form is an open source form state management program from TanStack. A security vulnerability exists in Google Chrome that stems from an improper implementation of the picture-in-picture feature...

PentestJudge: Judging Agent Behavior against Operational Requirements

We introduce PentestJudge, a system for evaluating the operations of penetration testing agents. PentestJudge is a large language model LLM-as-judge with access to tools that allow it to consume arbitrary trajectories of agent states and tool call history to determine whether a security agent's...