CVE-2025-30194 Denial of service via crafted DoH exchange

When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a denial of service by crafting a DoH exchange that triggers an illegal memory access double-free and crash of DNSdist, causing a denial of service. The remedy is: upgrade to the patched 1.9.9 version. A...

CVE-2025-30194

When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a denial of service by crafting a DoH exchange that triggers an illegal memory access double-free and crash of DNSdist, causing a denial of service. The remedy is: upgrade to the patched 1.9.9 version. A...

CVE-2025-30194

Summary (CVE-2025-30194) : When DNSdist is configured to serve DoH through the nghttp2 provider, an attacker can trigger an illegal memory access (double-free) via a crafted DoH exchange, causing a denial of service (crash). The vulnerability affects DNSdist’s DoH handling with nghttp2; an upgrad...

VulnCheck KEV: CVE-2021-27162

An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded user / tattoo@home credentials for an ISP...

Google Android Elevation of Privilege Vulnerability

Google Android is a Linux-based operating system from the American company Google. Google Android suffers from an elevation of privilege vulnerability that stems from a lack of privilege checking and can be exploited to bypass the read permission of a content provider. An attacker can exploit the...

SAGA: a Security Architecture for Governing AI Agentic Systems

Large Language Model LLM-based agents increasingly interact, collaborate, and delegate tasks to one another autonomously with minimal human interaction. Industry guidelines for agentic system governance emphasize the need for users to maintain comprehensive control over their agents, mitigating...

SONNI: Secure Oblivious Neural Network Inference

In the standard privacy-preserving Machine learning as-a-service MLaaS model, the client encrypts data using homomorphic encryption and uploads it to a server for computation. The result is then sent back to the client for decryption. It has become more and more common for the computation to be...

Timing Attack

Overview org.springframework.security:spring-security-crypto is a spring-security-crypto library for Spring Security. Affected versions of this package are vulnerable to Timing Attack due to an unintentional bypass for DaoAuthenticationProvider constant time controls, which was caused by the fix...

[SECURITY] Fedora 40 Update: rust-icu_provider-1.5.0-1.fc40

Trait and struct definitions for the ICU data provider...

[SECURITY] Fedora 42 Update: rust-icu_provider-1.5.0-1.fc42

Trait and struct definitions for the ICU data provider...

Security update for apache2-mod_auth_openidc

This update for apache2-modauthopenidc fixes the following issues: CVE-2025-31492: Fixed a bug where OIDCProviderAuthRequestMethod POSTs can leak protected data. bsc1240893 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or...

Security update for apache2-mod_auth_openidc

This update for apache2-modauthopenidc fixes the following issues: CVE-2025-31492: Fixed a bug where OIDCProviderAuthRequestMethod POSTs can leak protected data. bsc1240893 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or...

Prompt Engineering Techniques with Spring AI

This blog post demonstrates practical implementations of Prompt Engineering techniques using Spring AI. The examples and patterns in this article are based on the comprehensive Prompt Engineering Guide that covers the theory, principles, and patterns of effective prompt engineering. The blog show...

CVE-2024-51744 affecting package kube-vip-cloud-provider for versions less than 0.0.2-22

CVE-2024-51744 affecting package kube-vip-cloud-provider for versions less than 0.0.2-22. A patched version of the package is available...

Kentico Xperience cross-site scripting vulnerability (CNVD-2026-05133)

Kentico Xperience is a digital experience platform from Kentico. Kentico Xperience suffers from a cross-site scripting vulnerability due to .zip files being processed through TryZipProviderSafe, which can be exploited by an attacker to cause the creation of files with other extensions...

The vulnerability of the Apache Airflow Common SQL Provider software, which is used for creating, monitoring, and orchestrating data processing scripts in Airflow, stems from a lack of security measures regarding SQL query structures. This vulnerability allows attackers to enhance their privileges and execute arbitrary commands.

The vulnerability of the Apache Airflow Common SQL Provider software, which is used for creating, monitoring, and orchestrating data processing scenarios, relates to the lack of security measures taken to protect the SQL query structure during the execution of the SQLTableCheckOperator with the...

SAMSUNG Mobile devices 安全漏洞

SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc., from the South Korean company Samsung SAMSUNG. A security vulnerability exists in SAMSUNG Mobile devices SMR Apr-2025 Release 1 prior to Release 1, which stems from improper handling of privileges...

SQL Injection

Overview apache-airflow-providers-common-sql is a Provider package apache-airflow-providers-common-sql for Apache Airflow Affected versions of this package are vulnerable to SQL Injection via the partitionclause parameter in SQLTableCheckOperator. An attacker can escalate privileges and execute...

CVE-2025-30473

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Airflow Common SQL Provider. When using the partition clause in SQLTableCheckOperator as parameter which was a recommended pattern, Authenticated UI User could inject arbitrary SQL command...

CVE-2025-30473 Apache Airflow Common SQL Provider: Remote Code Execution via Sql Injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Airflow Common SQL Provider. When using the partition clause in SQLTableCheckOperator as parameter which was a recommended pattern, Authenticated UI User could inject arbitrary SQL command...