Google Android Information Disclosure Vulnerability (CNVD-2026-16154)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability. The vulnerability is caused by a possible way to access the GPU cache due to side channel information leakage in drawLayersInternal of SkiaRenderEngine.cp...

PT-2026-24059

Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permission to read-only wrapped user-mode memory. This is caused by improper handling of the memory protections for the user-mode wrapped memory resource...

HP Device Manager Vulnerability Update (5.0.16)

Potential vulnerabilities have been identified in HP Device Manager versions prior to HPDM 5.0.16. HP is releasing mitigation for the potential vulnerabilities as part of the 5.0.16 release. All of the identified vulnerabilities listed above were addressed and fixed as part of HP Device Manager...

GStreamer H.266 Codec Parser Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of decoding...

GNU Binutils objdump 安全漏洞

GNU Binutils objdump is a command-line tool for binary files in the American GNU community. GNU Binutils objdump has a security vulnerability, which stems from an error in the processing logic of the DWARF compilation unit when dealing with specially crafted binary files. This error may lead to t...

Challenges and Design Considerations for Finding CUDA Bugs through GPU-Native Fuzzing

Modern computing is shifting from homogeneous CPU-centric systems to heterogeneous systems with closely integrated CPUs and GPUs. While the CPU software stack has benefited from decades of memory safety hardening, the GPU software stack remains dangerously immature. This discrepancy presents a...

Medium: assertj-core

Issue Overview: AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine JVM. Starting in version 1.4.0 and prior to version 3.27.7, an XML External Entity XXE vulnerability exists in org.assertj.core.util.xml.XmlStringPrettyFormatter: the toXmlDocumentString method...

PT-2026-51776

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.0.13 Description The software uses bcrypt with a default salt round value of 5, resulting in only 32 iterations. This is significantly lower than the OWASP-recommended minimum of 10 rounds 1024 iterations. This...

CVE-2026-28399

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter. This issue has been patched in version 0.301.3...

OpenClaw Improperly Neutralizes Line Breaks in systemd Unit Generation Enables Local Command Execution (Linux)

Summary A command injection vulnerability exists in OpenClaw’s Linux systemd unit generation path. When rendering Environment= entries, attacker-controlled values are not rejected for CR/LF, and systemdEscapeArg uses an incorrect whitespace-matching regex. This allows newline injection to break o...

GHSA-VFFC-F7R7-RX2W OpenClaw Improperly Neutralizes Line Breaks in systemd Unit Generation Enables Local Command Execution (Linux)

Summary A command injection vulnerability exists in OpenClaw’s Linux systemd unit generation path. When rendering Environment= entries, attacker-controlled values are not rejected for CR/LF, and systemdEscapeArg uses an incorrect whitespace-matching regex. This allows newline injection to break o...

GHSA-45RP-9P97-H852 NocoDB Vulnerable to SQL Injection via DATEADD Formula

Summary An authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter. Details The third argument unit of DATEADD was interpolated directly into knex.raw queries after only stripping quote characters. Validation in formulas.ts only checked Literal AST...

NocoDB Vulnerable to SQL Injection via DATEADD Formula

Summary An authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter. Details The third argument unit of DATEADD was interpolated directly into knex.raw queries after only stripping quote characters. Validation in formulas.ts only checked Literal AST...

Choose the Right GPU on Akamai Cloud for Your AI Workload

...

PT-2026-24673

Summary A command injection vulnerability exists in OpenClaw’s Linux systemd unit generation path. When rendering Environment= entries, attacker-controlled values are not rejected for CR/LF, and systemdEscapeArg uses an incorrect whitespace-matching regex. This allows newline injection to break o...

SAMSUNG多款产品 安全漏洞

SAMSUNG Exynos 2400 and other chips are mobile processor components developed by Samsung Electronics of South Korea. Several Samsung products have security vulnerabilities; these vulnerabilities stem from a null pointer dereferencing in the setcpuaffinity function, npuprotodrv.ast.threadref, whic...

CVE-2023-31364

Improper handling of direct memory writes in the input-output memory management unit could allow a malicious guest virtual machine VM to flood a host with writes, potentially causing a fatal machine check error resulting in denial of service...

CVE-2025-48630

In drawLayersInternal of SkiaRenderEngine.cpp, there is a possible way to access the GPU cache due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-9241

In smmudetachdev of arm-smmu-v3.c, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48630

CVE-2025-48630 describes an information-disclosure vulnerability in Skia’s drawLayersInternal (SkiaRenderEngine.cpp) that could grant a local attacker access to GPU cache data, enabling local escalation of privilege with no extra privileges or user interaction required. Public documents consisten...