USN-7829-4: Linux kernel (AWS) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - GPU drivers; - Network drivers; - Netlink; CVE-2024-26700, CVE-2025-38727, CVE-2023-52593, CVE-2024-26896...

CVE-2025-59461 API does not require authentication

A remote unauthenticated attacker may use the unauthenticated C++ API to access or modify sensitive data and disrupt services...

Exploit for CVE-2025-59287

wsus-decoy Defensive proof of concept decoy for CVE-2025-5928...

CVE-2025-12080

CVE-2025-12080 affects Google Messages for Wear OS when it is the default SMS/MMS/RCS app. The root cause is improper handling of ACTION_SENDTO intents using sms:, smsto:, mms:, and mmsto: URI schemes, enabling an attacker who can invoke an Android intent to covertly send messages on behalf of th...

Uncovering Qilin attack methods exposed through multiple cases

In the second half of 2025, the ransomware group Qilin has continued to publish victim information on its leak site at a pace of more than 40 cases per month, making it one of the most impactful ransomware groups worldwide. The manufacturing sector has been the most affected, followed by...

Security Management System Unauthorized Access

The vulnerability of the Security Management System component of the Oracle Financial Services Revenue Management and Billing system is related to insufficient protection of operational data. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to...

Oracle Financial Services Analytical Applications Infrastructure Unauthorized Access

The vulnerability of the Oracle Financial Services Analytical Applications Infrastructure platform component related to insufficient access control measures. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...

Oracle Financial Services Analytical Applications Infrastructure Data Access

The vulnerability of the Oracle Financial Services Analytical Applications Infrastructure platform component related to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker to gain read, modify, or delete access to data...

PT-2025-43967

Name of the Vulnerable Software and Affected Versions Centreon Infra Monitoring versions 23.10.0 through 23.10.26 Centreon Infra Monitoring versions 24.04.0 through 24.04.16 Centreon Infra Monitoring versions 24.10.0 through 24.10.9 Description The software contains an Improper Neutralization of...

CVE-2025-10023: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Centreon Infra Monitoring Services Meta-services modules allows Stored XSS by users with elevated privileges.This issue affects Infra Monitoring: from 24.10.0 before 24.10.9, from 24.04.0...

Important: sssd

Issue Overview: A flaw was found in the integration of Active Directory and the System Security Services Daemon SSSD on Linux systems. In default configurations, SSSD does not enable the Kerberos local authentication plugin sssdkrb5localauthplugin, allowing an attacker with permission to modify...

Security Management System Unauthorized Access

The vulnerability of the Security Management System component of the Oracle Financial Services Revenue Management and Billing system is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

Oracle Financial Services Analytical Applications Infrastructure Full Control

The vulnerability of the Platform component for analytics and data management in Oracle Financial Services Analytical Applications Infrastructure relates to the lack of authentication for critical functions. Exploiting this vulnerability could allow a malicious actor to gain full control over the...

Oracle Financial Services Analytical Applications Infrastructure Unauthorized Access

The vulnerability of the Oracle Financial Services Analytical Applications Infrastructure platform component related to insufficient protection of operational data. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...

[SECURITY] Fedora 41 Update: sssd-2.11.1-2.fc41

Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy...

[SECURITY] Fedora 43 Update: sssd-2.11.1-4.fc43

Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy...

CVE-2025-62714

Karmada Dashboard is a general-purpose, web-based control panel for Karmada which is a multi-cluster management project. Prior to version 0.2.0, there is an authentication bypass vulnerability in the Karmada Dashboard API. The backend API endpoints e.g., /api/v1/secret, /api/v1/service did not...

Exploit for CVE-2025-59287

In this study, we will examine a critical vulnerability CVE-202...

KB5070883: Windows Server 2019 WSUS RCE (CVE-2025-59287)

The remote Windows host is missing security update 5070879, which addresses a remote code execution vulnerability in Windows Server Update Services WSUS. This plugin identifies vulnerable systems by performing the following checks: 1. Validates the host is an affected Windows Server instance. 2...

SUSE CVE-2025-59823

Project Gardener implements the automated management and operation of Kubernetes clusters as a service. Code injection may be possible in Gardener Extensions for AWS providers prior to version 1.64.0, Azure providers prior to version 1.55.0, OpenStack providers prior to version 1.49.0, and GCP...