[SECURITY] Fedora 42 Update: coreutils-9.6-4.fc42

These are the GNU core utilities. This package is the combination of the old GNU fileutils, sh-utils, and textutils packages...

Tinxy WiFi Lock Controller has a security vulnerability

Tinxy WiFi Lock Controller is a smart door lock from Tinxy. A security vulnerability exists in Tinxy WiFi Lock Controller v1. The vulnerability stems from storing sensitive user information in clear text, which may lead to information leakage...

Tinxy WiFi Lock Controller v1 has a RF security vulnerability

Tinxy WiFi Lock Controller v1 RF is a smart door lock from Tinxy. A security vulnerability exists in Tinxy WiFi Lock Controller v1 RF, which originates from transmitting sensitive information in clear text and could lead to a man-in-the-middle attack...

Security update for postgresql13

This update for postgresql13 fixes the following issues: Upgrade to 13.21: CVE-2025-4207: Fixed PostgreSQL GB18030 encoding validation can read one byte past end of allocation for text that fails validation bsc1242931 Changelog: https://www.postgresql.org/docs/release/13.21/ Patch Instructions: T...

Fooling the Watchers: Breaking AIGC Detectors Via Semantic Prompt Attacks

The rise of text-to-image T2I models has enabled the synthesis of photorealistic human portraits, raising serious concerns about identity misuse and the robustness of AIGC detectors. In this work, we propose an automated adversarial prompt generation framework that leverages a grammar tree...

Important: thunderbird

Issue Overview: Through a series of popup and window.print calls, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR 102.5, Thunderbird 102.5, and Firefo...

New warning issued over toll fee scams

Over a year ago the FBI warned about what was then a new form of smishing phishing via SMS scam: text messages that demanded payment for toll fees. The FTC sent out a similar warning in January, 2025. Then, in April another wave of toll fee scams began doing the rounds. Now the Departments of Mot...

Vuetify cross-site scripting vulnerabilities

vuetify is a material component framework for Vue open source by vuetify Germany. A cross-site scripting vulnerability exists in versions prior to vuetify 3.0.0, which stems from the eventMoreText property of the VCalendar component not being cleaned up correctly, which could lead to a cross-site...

Siemens Scalance LPE9403 Industrial Switches LPE Information Disclosure

The vulnerability of Siemens Scalance LPE9403 industrial switches’ microprogramming software relates to the transmission of secret information in the form of open text. Exploiting this vulnerability can allow an intruder to gain unauthorized access to the protected information...

The Feasibility of Topic-Based Watermarking on Academic Peer Reviews

Large language models LLMs are increasingly integrated into academic workflows, with many conferences and journals permitting their use for tasks such as language refinement and literature summarization. However, their use in peer review remains prohibited due to concerns around confidentiality...

Red-Teaming Text-To-Image Systems by Rule-Based Preference Modeling

Text-to-image T2I models raise ethical and safety concerns due to their potential to generate inappropriate or harmful images. Evaluating these models' security through red-teaming is vital, yet white-box approaches are limited by their need for internal access, complicating their use with...

Security update for postgresql14

This update for postgresql14 fixes the following issues: Upgrade to 14.18: CVE-2025-4207: Fixed PostgreSQL GB18030 encoding validation can read one byte past end of allocation for text that fails validation bsc1242931 Patch Instructions: To install this SUSE update use the SUSE recommended...

CVE-2025-24627

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Linnea Huxford Blur Text blur-text allows Stored XSS.This issue affects Blur Text: from n/a through = 1.0.0...

CVE-2025-0683

In its default configuration, Contec Health CMS8000 Patient Monitor transmits plain-text patient data to a hard-coded public IP address when a patient is hooked up to the monitor. This could lead to a leakage of confidential patient data to any device with that IP address or an attacker in a...

CVE-2025-22315

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPDeveloper Typing Text typing-text allows Stored XSS.This issue affects Typing Text: from n/a through = 1.2.7...

CVE-2024-52523

Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed credentials, the API returns them and adds them into the frontend again, allowing to read them in plain text when an attacker already has access to an active sessi...

CVE-2024-47337

Missing Authorization vulnerability in Phillip Dane Joy Of Text Lite joy-of-text.This issue affects Joy Of Text Lite: from n/a through = 2.3.1...

CVE-2024-44685

Titan SFTP and Titan MFT Server 2.0.25.2426 and earlier have a vulnerability a vulnerability where sensitive information, including passwords, is exposed in clear text within the JSON response when configuring SMTP settings via the Web UI...

CVE-2024-25024

IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 281430...

CVE-2025-3894

CVE-2025-3894 concerns MegaBIP: the text editor embedded in MegaBIP does not neutralize user input, enabling Stored XSS attacks across users. The issue requires high privileges to use the editor, with impact limited to if exploited in authenticated contexts as described; affected version detected...