CVE-2026-25961

SumatraPDF is a multi-format reader for Windows. In 3.5.0 through 3.5.2, SumatraPDF's update mechanism disables TLS hostname verification INTERNETFLAGIGNORECERTCNINVALID and executes installers without signature checks. A network attacker with any valid TLS certificate e.g., Let's Encrypt can...

[SECURITY] Fedora 42 Update: rust-resctl-bench-2.2.5-10.fc42

resctl-bench is a collection of whole-system benchmarks to evaluate resource control and hardware behaviors using realistic simulated workloads. Comprehensive resource control involves the whole system. Furthermore, testing resource control end-to-end requires scenarios involving realistic...

ZBT WE2001 安全漏洞

ZBT WE2001 is a wireless router produced by ZBT Technology Co., Ltd. Version 23.09.27 of ZBT WE2001 contains a security vulnerability. This vulnerability stems from a lack of session verification in the Web API component, which may allow unauthenticated remote attackers to obtain device...

sunbird-portal 安全漏洞

sunbird-portal is an open-source portal developed by Sunbird-ED. Version 1.13.4 of sunbird-portal contains a security vulnerability. This vulnerability stems from the application disabling TLS/SSL certificate verification by setting rejectUnauthorized to false, which may allow attackers to obtain...

The vulnerability of the EdDSA digital signature algorithm implementation in EdDSA-Java (ed25519-java) arises from incorrect verification of the EdDSA cryptographic signature. This allows a perpetrator to replace the cryptographic signature with an unauthorized one.

The vulnerability of the EdDSA digital signature algorithm implementation in EdDSA-Java ed25519-java is related to incorrect verification of the EdDSA cryptographic signature. Exploiting this vulnerability could allow an attacker to replace the cryptographic signature...

WordPress plugin Videospirecore Theme Plugin 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: openssl (UTSA-2026-005351)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005351 advisory. Issue summary: A type confusion vulnerability exists in the TimeStamp Response verification code where an ASN1TYPE union member is accessed without first validating...

BusyBox 安全漏洞

BusyBox is a set of applications developed by Denis Vlasenko from Ukraine. It contains multiple Linux commands and tools. BusyBox has a security vulnerability; this vulnerability arises from the lack of verification during the extraction of hard links or symbolic links in tar archives. This may...

Palo Alto Networks PAN-OS 安全漏洞

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks for its firewall devices. There is a security vulnerability in Palo Alto Networks PAN-OS, which stems from improper certificate verification. This vulnerability may allow users to connect to terminal server proxies o...

The vulnerability of the JSON Web Token Handler component of the Keycloak identity and access management software allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the JSON Web Token Handler component in the software for managing identification and access in Keycloak is related to errors in verifying the cryptographic signature. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to...

CVE-2026-26007

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the publickeyfromnumbers or EllipticCurvePublicNumbers.publickey, EllipticCurvePublicNumbers.publickey, loadderpublickey and loadpempublickey functions do not verify that the...

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in public key functions publickeyfromnumbers, EllipticCurvePublicNumbers.publickey, loadderpublickey, and loadpempublickey, which may reveal bits from a private key when provided with a...

CVE-2025-62439

An Improper Verification of Source of a Communication Channel vulnerability CWE-940 vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions may allow an authenticated user with knowledge of FSSO policy configurations t...

80% of Fortune 500 use active AI Agents: Observability, governance, and security shape the new frontier

Today, Microsoft is releasing the new Cyber Pulse report to provide leaders with straightforward, practical insights and guidance on new cybersecurity risks. One of today’s most pressing concerns is the governance of AI and autonomous agents. AI agents are scaling faster than some companies can s...

CVE-2025-62439

An Improper Verification of Source of a Communication Channel vulnerability CWE-940 vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions may allow an authenticated user with knowledge of FSSO policy configurations t...

CVE-2025-62439

An Improper Verification of Source of a Communication Channel vulnerability CWE-940 vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions may allow an authenticated user with knowledge of FSSO policy configurations t...

CVE-2025-62439

CVE-2025-62439 : Fortinet FortiOS contains an vulnerability titled “Improper Verification of Source of a Communication Channel” (CWE-940). Affected products/versions are FortiOS 7.6.0–7.6.4, 7.4.0–7.4.9, and all 7.2 and 7.0 releases. Affected condition: an authenticated user with knowledge of FSS...

Discord will limit profiles to teen-appropriate mode until you verify your age

Discord announced it will put all existing and new profiles in teen-appropriate mode by default in early March. The teen-appropriate profile mode will remain in place until users prove they are adults. To change a profile to “full access” will require verification by Discord’s age inference model...

Most Engagement Data Is Compromised and That’s a Major Security Problem

Most engagement data is compromised by bots and spoofing. Datavault AI treats engagement as a security problem, verifying real human actions at the source...

Poland Energy Sector Cyber Incident Highlights OT and ICS Security Gaps

The purpose of this Alert is to amplify Poland’s Computer Emergency Response Team CERT Polska’s Energy Sector Incident Report published on Jan. 30, 2026, and highlight key mitigations for Energy Sector stakeholders. In December 2025, a malicious cyber actors targeted and compromised operational...