TikTok Slammed With €530 Million GDPR Fine for Sending E.U. Data to China

Ireland's Data Protection Commission DPC on Friday fined popular video-sharing platform TikTok €530 million $601 million for infringing data protection regulations in the region by transferring European users' data to China. "TikTok infringed the GDPR regarding its transfers of EEA European...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the i915 driver overstepping its bounds when accessing the maxsubslices array...

CVE-2025-43916

Sonos api.sonos.com through 2025-04-21, when the /login/v3/oauth endpoint is used, accepts a redirecturi containing userinfo in the authority component, which is not consistent with RFC 6819 section 5.2.3.5. An authorization code may be sent to an attacker-controlled destination. This might have...

CVE-2025-46613

OpenPLC 3 through 64f9c11 has server.cpp Memory Corruption because a thread may access handleConnections arguments after the parent stack frame becomes unavailable...

SUSE CVE-2025-22121

In the Linux kernel, the following vulnerability has been resolved: ext4: fix out-of-bound read in ext4xattrinodedecrefall There's issue as follows: BUG: KASAN: use-after-free in ext4xattrinodedecrefall+0x6ff/0x790 Read of size 4 at addr ffff88807b003000 by task syz-executor.0/15172 CPU: 3 PID:...

Did DOGE “breach” Americans’ data? (Lock and Code S06E08)

This week on the Lock and Code podcast … If you don't know about the newly created US Department of Government Efficiency DOGE, there's a strong chance they already know about you. Created on January 20 by US President Donald Trump through Executive Order, DOGE's broad mandate is “modernizing...

CVE-2025-22123

CVE-2025-22123 relates to the Linux kernel’s F2FS filesystem. The issue arises when a faulty allocator path introduced by a commit (FAULT_NO_SEGMENT) may set curseg->segno to NULL_SEGNO while CP_ERROR_FLAG is set. This can lead to a page fault path where f2fs_write_inode() traverses a sequence...

The vulnerability of the vmw_dumb_create() function in the Linux kernel’s Direct Rendering Infrastructure (DRI) support driver allows a malicious actor to cause a service failure.

The vulnerability of the vmwdumbcreate function in the Linux kernel’s Direct Rendering Infrastructure DRI driver relates to a violation of the buffer boundary. Exploiting this vulnerability can allow an attacker to trigger a service failure...

CVE-2025-0050

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to make valid GPU processing operations,...

SUSE SLES15: libavcodec58_134 / libavformat58_76 / libavutil56_70 / etc (SUSE-SU-2025:1128-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1128-1 advisory. - CVE-2020-22037: Fixed unchecked return value of the initvlc function bsc1186756 - CVE-2024-12361: Fixed null pointer dereference...

BIT-JOOMLA-2020-35610 [20201101] - Core - com_finder ignores access levels on autosuggest

An issue was discovered in Joomla! 2.5.0 through 3.9.22. The autosuggestion feature of comfinder did not respect the access level of the corresponding terms...

Unsafe `Deserialization` in `JsonPickleSerializer` Enables Remote Code Execution

Description A critical deserialization vulnerability exists in the llamaindex library’s JsonPickleSerializer component, enabling remote code execution RCE due to an insecure fallback to Python’s pickle module. When deserializing untrusted data, JsonPickleSerializer prioritizes pickle.loads, which...

E-Solutions E-Management 路径遍历漏洞

E-Solutions E-Management is an application from E-Solutions, Inc. A path traversal vulnerability exists in E-Solutions E-Management that originates from path traversal and could result in access to confidential files outside of the expected scope...

Hackers Repurpose RansomHub's EDRKillShifter in Medusa, BianLian, and Play Attacks

A new analysis has uncovered connections between affiliates of RansomHub and other ransomware groups like Medusa, BianLian, and Play. The connection stems from the use of a custom tool that's designed to disable endpoint detection and response EDR software on compromised hosts, according to ESET...

CVE-2025-2600

Improper authorization in the variable component in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use the ELEVATEDPASSWORD variable even though not allowed by the "Allow password in variable policy". This issue affects Remote Desktop Manager versions from 2025.1.24...

CVE-2024-7598 Network restriction bypass via race condition during namespace termination

A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace termination is not defined, and it is possible for network policies ...

CVE-2024-7767 Improper Access Control in danswer-ai/danswer

An improper access control vulnerability exists in danswer-ai/danswer version v0.3.94. This vulnerability allows the first user created in the system to view, modify, and delete chats created by an Admin. This can lead to unauthorized access to sensitive information, loss of data integrity, and...

CVE-2024-2292 Access Control Vulnerabilities lead to Violation of Privacy and Modification of Personal Data

Due to a lack of access control, unauthorized users are able to view and modify information pertaining to other users...

CVE-2024-2292 Access Control Vulnerabilities lead to Violation of Privacy and Modification of Personal Data

Due to a lack of access control, unauthorized users are able to view and modify information pertaining to other users...

SUSE-SU-2025:0862-1 Security update for ffmpeg-4

This update for ffmpeg-4 fixes the following issues: - CVE-2025-22921: Fixed segmentation violation in NULL pointer dereference via the component /libavcodec/jpeg2000dec.c bsc1237382. - CVE-2025-25473: Fixed memory leak in avformatfreecontext bsc1237351. - CVE-2025-0518: Fixed unchecked sscanf...