American Archive of Public Broadcasting allowed access to restricted media for years

A security flaw in the American Archive of Public Broadcasting AAPB website allowed unauthorized access to protected and private media, according to BleepingComputer. The American Archive of Public Broadcasting AAPB is a collaborative initiative between the Library of Congress and WGBH Educationa...

ROS-20250923-06

A vulnerability in the Apache Cassandra distributed database management system is related to improper privilege handling. Exploitation of the vulnerability could allow a remote attacker to compromise the confidentiality, integrity, and availability of protected information. impact the...

The vulnerability of the cairodebugresetstatic_data() function in the Poppler PDF rendering library allows a hacker to gain unauthorized access to protected information.

The vulnerability of the cairodebugresetstaticdata function in the Poppler PDF rendering library is related to an uncontrolled and exploitable condition. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

The vulnerabilities of the software for remote management and monitoring of the Intel Converged Security and Manageability Engine (CSME) and the software for remote management and monitoring of the Intel Server Platform Services (SPS) are related to manipulating an unknown input, resulting in a timing mismatch that allows a perpetrator to disclose protected information.

The vulnerabilities of the software for remote management and monitoring of the Intel Converged Security and Manageability Engine CSME and the software for remote management and monitoring of the Intel Server Platform Services SPS are related to manipulating an unknown input, resulting in a timin...

CVE-2025-10015

The Sparkle framework includes an XPC service Downloader.xpc, by default this service is private to the application its bundled with. A local unprivileged attacker can register this XPC service globally which will inherit TCC permissions of the application. Lack of validation of connecting client...

CVE-2025-9808

The The Events Calendar plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.15.2 via the REST endpoint. This makes it possible for unauthenticated attackers to extract information about password-protected vendors or venues...

[SECURITY] Fedora 42 Update: lemonldap-ng-2.21.3-1.fc42

LemonLdap::NG is a modular Web-SSO based on Apache::Session modules. It simplifies the build of a protected area with a few changes in the application. It manages both authentication and authorization and provides headers for accounting. So you can have a full AAA protection for your web space as...

CVE-2025-43285

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to access protected user data...

CVE-2025-43321

The issue was resolved by blocking unsigned services from launching on Intel Macs. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to access protected user data...

CVE-2025-43311

This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to access protected user data...

CVE-2025-43369

This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Tahoe 26. An app may be able to access protected user data...

CVE-2025-43291

A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to modify protected parts of the file system...

CVE-2025-31268

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to access protected user data...

CVE-2025-31269

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to access protected user data...

CVE-2025-31270

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to access protected user data...

Rockwell Automation 1756-EN4TR, 1756-EN4TRXT Improper Input Validation (CVE-2025-8007)

A security issue exists in the protected mode of 1756-EN4TR and 1756-EN2TR communication modules, where a Concurrent Forward Close operation can trigger a Major Non-Recoverable MNFR fault. This condition may lead to unexpected system crashes and loss of device availability. This plugin only works...

Rockwell Automation 1756-EN4TR, 1756-EN4TRXT Improper Handling of Exceptional Conditions (CVE-2025-8008)

A security issue exists in the protected mode of EN4TR devices, where sending specifically crafted messages during a Forward Close operation can cause the device to crash. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

CVE-2023-53319 KVM: arm64: Handle kvm_arm_init failure correctly in finalize_pkvm

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle kvmarminit failure correctly in finalizepkvm Currently there is no synchronisation between finalizepkvm and kvmarminit initcalls. The finalizepkvm proceeds happily even if kvmarminit fails resulting in the...

CVE-2025-10015

The Sparkle framework includes an XPC service Downloader.xpc, by default this service is private to the application its bundled with. A local unprivileged attacker can register this XPC service globally which will inherit TCC permissions of the application. Lack of validation of connecting client...

CVE-2025-10015 TCC Bypass via Downloader XPC Service in Sparkle

The Sparkle framework includes an XPC service Downloader.xpc, by default this service is private to the application its bundled with. A local unprivileged attacker can register this XPC service globally which will inherit TCC permissions of the application. Lack of validation of connecting client...