CAPIO: Safe Kernel-Bypass of Commodity Devices Using Capabilities

Securing low-latency I/O in commodity systems forces a fundamental trade-off: rely on the kernel's high overhead mediated interface, or bypass it entirely, exposing sensitive hardware resources to userspace and creating new vulnerabilities. This dilemma stems from a hardware granularity mismatch:...

ROS-20251216-7369

A vulnerability in the WebXR component of Google Chrome and Microsoft Edge browsers is related to reading data outside the buffer boundaries in memory. Exploitation of the vulnerability could allow a remote attacker to gain unauthorized access to protected information...

ROS-20251216-7337

A vulnerability in the Core component of the Oracle VM VirtualBox virtualization software tool is related to an access control flaw. Exploitation of the vulnerability may allow an attacker to gain unauthorized access to protected information...

ROS-20251216-7371

A vulnerability in the Extensions component of Google Chrome and Microsoft Edge browsers is related to incorrect resource initialization. Exploitation of the vulnerability may allow a remote attacker to gain unauthorized access to protected information...

ROS-20251216-7340

A vulnerability in the qemuFwCfgMmioRead function of the Box/Devices/PC/DevQemuFwCfg.cpp component of the Oracle VM VirtualBox virtualization software tool is related to integer overflow. Exploitation of the vulnerability may allow an intruder to gain unauthorized access to protected information...

ROS-20251216-7363

A vulnerability in the Extensions component of Google Chrome and Microsoft Edge browsers is related to access control flaws. Exploitation of the vulnerability could allow a remote attacker to gain unauthorized access to protected information...

ROS-20251216-7308

Vulnerability in guacamole related to unchecked array indexing. Exploitation of the vulnerability may allow an attacker to affect confidentiality, integrity and availability of protected information...

ROS-20251216-7338

A vulnerability in the Core component of the Oracle VM VirtualBox virtualization software tool is related to an access control flaw. Exploitation of the vulnerability could allow an attacker to gain unauthorized access to protected information...

ROS-20251216-7336

A vulnerability in the Core component of the Oracle VM VirtualBox virtualization software tool is related to an access control flaw. Exploitation of the vulnerability may allow an attacker to gain unauthorized access to protected information...

ROS-20251216-7365

A vulnerability in the Ozone component of Google Chrome and Microsoft Edge browsers is related to memory usage after it has been freed. Exploitation of the vulnerability could allow a remote attacker to affect the confidentiality, integrity and availability of protected information...

ROS-20251216-7360

A vulnerability in the V8 JavaScript script handler of Google Chrome and Microsoft Edge browsers is related to errors in the implementation of security checks for standard elements. Exploitation of the vulnerability may allow a remote attacker to gain unauthorized access to protected information...

CVE-2025-14148 IBM DevOps Deploy is susceptible to a Insufficiently Protected Credentials vulnerability

IBM UCD - IBM DevOps Deploy 8.1 through 8.1.2.3 could allow an authenticated user with LLM integration configuration privileges to recover a previously saved LLM API Token...

CVE-2025-14148

CVE-2025-14148 affects IBM UCD - IBM DevOps Deploy versions 8.1 through 8.1.2.3. An authenticated user with LLM integration configuration privileges can recover a previously saved LLM API Token, exposing credentials. Root cause identified as insufficiently protected credentials (CWE-522). CVSSv3....

CVE-2025-14148 IBM DevOps Deploy is susceptible to a Insufficiently Protected Credentials vulnerability

IBM UCD - IBM DevOps Deploy 8.1 through 8.1.2.3 could allow an authenticated user with LLM integration configuration privileges to recover a previously saved LLM API Token...

ROS-20251215-7314

A vulnerability in the Yelp help system is related to the inclusion of functions from an invalid controlled scope when processing documents using the ghelp schema. Exploitation of the vulnerability may allow a remote attacker to gain unauthorized access to protected information and execute...

CVE-2025-43416

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. An app may be able to access protected user data...

CVE-2025-43461

This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Tahoe 26.1. An app may be able to access protected user data...

CVE-2025-43351

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to access protected user data...

CVE-2025-43381

This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Tahoe 26.1. A malicious app may be able to delete protected user data...

CVE-2025-46289

A logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. An app may be able to access protected user data...