USN-7853-1: Linux kernel vulnerabilities

Jean-Claude Graf, Sandro Rüegge, Ali Hajiabadi, and Kaveh Razavi discovered that the Linux kernel contained insufficient branch predictor isolation between a guest and a userspace hypervisor for certain processors. This flaw is known as VMSCAPE. An attacker in a guest VM could possibly use this t...

USN-7853-1 linux, linux-aws, linux-aws-hwe, linux-gcp, linux-gcp-4.15, linux-hwe, linux-oracle vulnerabilities

Jean-Claude Graf, Sandro Rüegge, Ali Hajiabadi, and Kaveh Razavi discovered that the Linux kernel contained insufficient branch predictor isolation between a guest and a userspace hypervisor for certain processors. This flaw is known as VMSCAPE. An attacker in a guest VM could possibly use this t...

GO-2025-4061 Mattermost Server exposes sensitive information about team URLs via an API in github.com/mattermost/mattermost-server

Mattermost Server exposes sensitive information about team URLs via an API in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...

GO-2025-4063 Mattermost Server exposes account details to any Team Administrator in github.com/mattermost/mattermost-server

Mattermost Server exposes account details to any Team Administrator in github.com/mattermost/mattermost-server...

CVE-2025-64219

Missing Authorization vulnerability in Strategy11 Team Business Directory business-directory-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Business Directory: from n/a through = 6.4.18...

EUVD-2025-36617

Missing Authorization vulnerability in Strategy11 Team Business Directory business-directory-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Business Directory: from n/a through = 6.4.18...

CVE-2025-64219

CVE-2025-64219 is a Missing Authorization / Broken Access Control vulnerability affecting the WordPress Business Directory plugin (Strategy11 Team Business Directory) versiones up to and including 6.4.18. The Red Hat and ENISA/ENISA-ENISA-aligned entries confirm a vulnerability where access contr...

PT-2025-44254

Name of the Vulnerable Software and Affected Versions Business Directory versions through 6.4.18 Description A missing authorization issue exists in Strategy11 Team Business Directory business-directory-plugin. This allows exploitation due to incorrectly configured access control security levels...

Siemens SIMATIC Devices Improper Locking (CVE-2024-58071)

team: prevent adding a device which is already a team device lower This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid503513; scriptversion"1.2";...

kiro-redteam-lite

kiro-redteam-lite Red Team Automation Lite: Focused on...

CVE-2025-22177

Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view other team overviews...

Strings in the maze: Finding hidden strengths and gaps in your team

Welcome to this week's edition of the Threat Source newsletter. "The truth about the world, he said, is that anything is possible... For existence has its own order and that no man's mind can compass, that mind itself being but a fact among others." ― Cormac McCarthy, "Blood Meridian" Earlier thi...

CVE-2025-53297

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in AA-Team Woocommerce Envato Affiliates wooenvato allows Reflected XSS.This issue affects Woocommerce Envato Affiliates: from n/a through = 1.2.1...

CVE-2025-11818

The WP Responsive Meet The Team plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wprmteam' shortcode in all versions up to, and including, 1.0.1. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

A Bootiful Podcast: Spring team engineer Dariusz Jędrzejczyk on the latest-and-greatest in the reactive world, MCP, and more

Hi, Spring fans! In this installment we talk to the Spring team engineer Dariusz Jędrzejczyk on the latest-and-greatest in the reactive world, MCP, and more...

Risk Psychology and Cyber-Attack Tactics

We examine whether measured cognitive processes predict cyber-attack behavior. We analyzed data that included psychometric scale responses and labeled attack behaviors from cybersecurity professionals who conducted red-team operations against a simulated enterprise network. We employed multilevel...

CVE-2025-22177

Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view other team overviews...

CVE-2025-22177

Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view other team overviews...

CVE-2025-22177

Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view other team overviews...

CVE-2025-22177

Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view other team overviews...