PT-2025-47284

Name of the Vulnerable Software and Affected Versions Live sales notification for WooCommerce plugin for WordPress versions prior to 2.3.39 Description The Live sales notification for WooCommerce plugin for WordPress is affected by a missing authorization issue. The getOrders function does not ha...

Today’s threat landscape demands a proactive OT security strategy

Today’s threat landscape demands a proactive OT security strategy By John Fokker and Mo Cashman · November 18, 2025 Overview: The operational technology OT security landscape is undergoing rapid transformation, marked by an escalation in advanced threats. As reported in Trellix’s November...

DNS BIND Predictable State Data Compromise

The vulnerability of the BIND DNS server relates to predictability due to the observation of its status. Exploiting this vulnerability allows a remote attacker to compromise the integrity of the protected information...

Linux mlxreg_fan_set_cur_state Buffer Overflow DoS

The vulnerability of the mlxregfansetcurstate function in the drivers/hwmon/mlxreg-fan.c module of the Linux device monitoring driver is related to the execution of operations outside of the buffer boundaries. Exploiting this vulnerability could allow an attacker to cause a system failure...

It's a Feature, Not a Bug: Secure and Auditable State Rollback for Confidential Cloud Applications

Replay and rollback attacks threaten cloud application integrity by reintroducing authentic yet stale data through an untrusted storage interface to compromise application decision-making. Prior security frameworks mitigate these attacks by enforcing forward-only state transitions state continuit...

fs btrfs Heap Buffer Overflow DoS

The vulnerability of the btrfsreplacefileextents function in the fs/btrfs/file.c module of the file system support for the Linux operating system is related to insufficient checking of exception states. Exploiting this vulnerability could allow an attacker to cause a service failure...

Chinese State Hackers Jailbroke Claude AI Code for Automated Breaches

Anthropic, the developer behind Claude AI, says a Chinese state sponsored group used its model to automate most of a cyber espionage operation against about 30 companies with Claude handling up to 90% of the technical work...

Chinese Tech Firm Leak Reportedly Exposes State Linked Hacking

A massive data leak reportedly at Chinese firm Knownsec Chuangyu exposed 12,000 files detailing state-backed 'cyber weapons' and spying on over 20 countries. See the details, including 95GB of stolen Indian immigration data...

media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try()

...

SUSE CVE-2025-40207

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-subdev: Fix alloc failure check in v4l2subdevcallstatetry v4l2subdevcallstatetry macro allocates a subdev state with v4l2subdevstatealloc, but does not check the returned value. If v4l2subdevstatealloc fails, it retur...

Linux kernel check_cfg DoS

The vulnerability of the checkcfg function in the Linux operating system’s kernel is related to state management errors. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Linux kernel Heap Buffer Overflow DoS

The vulnerability of the bpfskbpulldata function in the Linux operating system’s kernel is related to state management errors. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

SoK: Security Evaluation of Wi-Fi CSI Biometrics: Attacks, Metrics, and Systemic Weaknesses

Wi-Fi Channel State Information CSI has been repeatedly proposed as a biometric modality, often with reports of high accuracy and operational feasibility. However, the field lacks a consolidated understanding of its security properties, adversarial resilience, and methodological consistency. This...

CVE-2024-44630

Multiple parameters in register.php in PHPGurukul Student Record System 3.20 are vulnerable to SQL injection. These include: c-full, fname, mname,lname, gname, ocp, nation, mobno, email, board1, roll1, pyear1, board2, roll2, pyear2, sub1,marks1, sub2, course-short, income, category, ph, country,...

EUVD-2024-55078

Multiple parameters in register.php in PHPGurukul Student Record System 3.20 are vulnerable to SQL injection. These include: c-full, fname, mname,lname, gname, ocp, nation, mobno, email, board1, roll1, pyear1, board2, roll2, pyear2, sub1,marks1, sub2, course-short, income, category, ph, country,...

CVE-2025-40148

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add NULL pointer checks in dcstream cursor attribute functions The function dcstreamsetcursorattributes currently dereferences the stream pointer and nested members stream-ctx-dc-currentstate without checking for...

CVE-2025-64529

A vulnerability has been identified in the WriteRelationships API of SpiceDB, where large relationship-update requests can be silently dropped when the payload exceeds what the underlying datastore permits. This occurs because the server does not always return an error when processing oversized...

Prototype Pollution

parse is vulnerable to Prototype Pollution. The vulnerability is due to improper handling of user-supplied input in the SingleInstanceStateController.initializeState function, which allows an attacker to inject malicious properties into Object.prototype via a crafted payload, leading to denial of...

EUVD-2025-150367

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-subdev: Fix alloc failure check in v4l2subdevcallstatetry v4l2subdevcallstatetry macro allocates a subdev state with v4l2subdevstatealloc, but does not check the returned value. If v4l2subdevstatealloc fails, it retur...

PT-2025-51621

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains an issue within the widen imprecise scalars function related to stack depth accounting. The function does not properly account for differences in allocated stac...