Ex-Google Engineer Convicted for Stealing AI Secrets for China Startup

A former Google engineer accused of stealing thousands of the company's confidential documents to build a startup in China has been convicted in the U.S., the Department of Justice DoJ announced Thursday. Linwei Ding aka Leon Ding, 38, was convicted by a federal jury on seven counts of economic...

MGASA-2026-0027 Updated libxml2 packages fix security vulnerabilities

xmlcatalog xmlParseSGMLCatalog recursion. CVE-2025-8732 Unbounded relaxng include recursion leading to stack overflow. CVE-2026-0989 Denial of service via uncontrolled recursion in xml catalog processing. CVE-2026-0990 Denial of service via crafted xml catalogs. CVE-2026-0992...

SUSE CVE-2025-69421

Issue summary: Processing a malformed PKCS12 file can trigger a NULL pointer dereference in the PKCS12itemdecryptd2iex function. Impact summary: A NULL pointer dereference can trigger a crash which leads to Denial of Service for an application processing PKCS12 files. The PKCS12itemdecryptd2iex...

Tenda W30E XSS

The vulnerability in the web interface for managing Tenda W30E micro-programming software is related to the lack of mechanisms for encoding or shielding output data during the processing of headers. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks XSS...

CVE-2025-68934

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, authenticated users can submit crafted payloads to /drafts.json that cause On^2 processing in Base62.decode, tying up workers for 35-60 seconds per request. This affects all users as t...

iperf3: iperf Heap Buffer Overflow

A flaw was found in iperf3. An off-by-one error in the iperfauth.c file leads to a heap-based buffer overflow, potentially allowing a network attacker to trigger an application-level denial of service. This overflow occurs during the processing of authentication data. The vulnerability can only b...

CVE-2025-15542

CVE-2025-15542 describes a DoS in VX800v v1.0’s SIP processing caused by improper handling of exceptional conditions. An attacker can flood the device with crafted INVITE messages, blocking all voice lines and disrupting incoming calls. The issue is documented across multiple sources (NVD/Red Hat...

CVE-2025-15542

Improper handling of exceptional conditions in VX800v v1.0 in SIP processing allows an attacker to flood the device with crafted INVITE messages, blocking all voice lines and causing a denial of service on incoming calls...

Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)

Summary Multiple vulnerabilities were remediated in IBM Observability with Instana OnPrem build 1.0.311 Vulnerability Details CVEID:CVE-2025-4878 DESCRIPTION: A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in the privatekeyfromfile function...

CVE-2025-65891

A GPU device-ID validation flaw in OneFlow v0.9.0 allows attackers to trigger a Denial of Dervice DoS by invoking flow.cuda.getdeviceproperties with an invalid or negative device index...

Important: Red Hat Security Advisory: openssl security update

An update for openssl is now available for Red Hat Enterprise Linux 9.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing

A flaw was found in OpenSSL. When processing a specially crafted PKCS12 Personal Information Exchange Syntax Standard file, a remote attacker can exploit an out-of-bounds write vulnerability. This issue, occurring within the OPENSSLuni2utf8 function, leads to memory corruption by writing data...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: squid (UTSA-2026-005214)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005214 advisory. Squid is a caching proxy for the Web. In versions 6.3 and below, Squid is vulnerable to a heap buffer overflow and possible remote code execution attack when...

RHEL 9 : openssl (RHSA-2026:1519)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:1519 advisory. OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength...

Qualcomm Heap Buffer Overflow Information Disclosure

The vulnerability of embedded Qualcomm software lies in the reading of data beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to disclose protected information during the processing of the MBN file hash segment...

CVE-2025-15542: Improper Check for Unusual or Exceptional Conditions

Improper handling of exceptional conditions in VX800v v1.0 in SIP processing allows an attacker to flood the device with crafted INVITE messages, blocking all voice lines and causing a denial of service on incoming calls...

Qualcomm Embedded Software Buffer Overflow Information Disclosure

The vulnerability of microprogramming software in embedded chips from Qualcomm arises due to overflow in the buffer on the stack. Exploiting this vulnerability can allow an attacker to disclose protected information during the processing of packets with invalid header lengths based on the EAVB BE...

ROS-20260129-73-0022

Vulnerability in ImageMagick related to an operation exceeding buffer boundaries in memory. The vulnerability can be exploited remotely...

EGroupware has SQL Injection in Nextmatch Filter Processing

Summary Critical Authenticated SQL Injection in Nextmatch Widget Filter Processing A critical SQL Injection vulnerability exists in the core components of EGroupware, specifically in the Nextmatch filter processing. The flaw allows authenticated attackers to inject arbitrary SQL commands into the...

CVE-2025-61730

The crypto/tls component in the Go programming language is vulnerable to a flaw where TLS 1.3 handshake messages might be processed at an incorrect encryption level . Specifically, if multiple messages are sent in records spanning encryption level boundaries (e.g., Client Hello and Encrypted Exte...