Aggregator

A vulnerability was found in INTUMIT SmartRobot up to 7.x and classified as critical. This issue affects some unknown processing. Such manipulation leads to server-side request forgery. This vulnerability is documented as CVE-2025-3572. The attack can be executed remotely. There is not any exploit available. It is suggested to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.6.87/6.12.23/6.13.11/6.14.2. It has been rated as critical. This affects the function hang_hws. The manipulation leads to null pointer dereference. This vulnerability is traded as CVE-2025-37853. Access to the local network is required for this attack to succeed. There is no exploit available. Upgrading the affected component is advised.

A vulnerability has been found in Linux Kernel up to 6.12.23/6.13.11/6.14.2/6.15-rc1 and classified as critical. The affected element is the function ivpu_ms_cleanup. The manipulation leads to deadlock. This vulnerability is documented as CVE-2025-37847. The attack requires being on the local network. There is not any exploit available. The affected component should be upgraded.

A vulnerability categorized as critical has been discovered in Linux Kernel up to 6.12.23/6.13.11/6.14.2/6.15-rc1. Affected by this vulnerability is the function ivpu_ms_cleanup. Executing manipulation can lead to deadlock. This vulnerability is handled as CVE-2025-37848. The attack can only be done within the local network. There is not any exploit available. It is advisable to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.1.134/6.6.87/6.12.23/6.13.11/6.14.2 and classified as critical. The impacted element is the function kvm_arch_vcpu_create. The manipulation results in use after free. This vulnerability is reported as CVE-2025-37849. The attacker must have access to the local network to execute the attack. No exploit exists. It is suggested to upgrade the affected component.

A vulnerability identified as critical has been detected in Linux Kernel up to 6.1.134/6.6.87/6.12.23/6.13.11/6.14.2. Affected by this issue is the function amdgpu_cgs_create_device. The manipulation leads to null pointer dereference. This vulnerability is uniquely identified as CVE-2025-37852. The attack can only be initiated within the local network. No exploit exists. You should upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.15-rc1. It has been classified as critical. This affects the function pwm_mediatek_config of the file drivers/pwm/pwm-mediatek.o. This manipulation causes divide by zero. This vulnerability appears as CVE-2025-37850. The attacker needs to be present on the local network. There is no available exploit. Upgrading the affected component is recommended.

A vulnerability described as problematic has been identified in Linux Kernel up to 6.14.2. This issue affects the function dispc_ovl_setup of the component fbdev. Such manipulation leads to improper initialization. This vulnerability is referenced as CVE-2025-37851. The attack needs to be initiated within the local network. No exploit is available. Upgrading the affected component is recommended.

A vulnerability, which was classified as problematic, has been found in Synology DiskStation Manager, Unified Controller and BeeStation Manager. Impacted is an unknown function of the component WebAPI. Performing manipulation results in escaping of output. This vulnerability was named CVE-2024-50629. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

U.S. government agencies have been given a shorter window than usual to patch a critical vulnerability affecting Fortinet's FortiWeb firewall product.

HiddenLayer reveals the EchoGram vulnerability, which bypasses safety guardrails on GPT-5.1 and other major LLMs, giving security teams just a 3-month head start.

Самый безопасный сегмент ИТ-инфраструктуры оказался самым интересным для злоумышленников.

根据 Mercury Research 的数据， 2025 年第三季度 AMD 占 x86 CPU 市场的份额突破四分之一。x86 CPU 的三季度出货量与二季度持平，但主要是英特尔出货量疲软，AMD 占 x86 客户端和服务器 CPU 出货量突破 25% 达到 25.6%，比上一季度的 24.2% 增加了 1.4%，英特尔仍然占 74.4%，AMD 的桌面 x86 CPU 出货量占比超过 33%。如果加上嵌入式系统、物联网和游戏机 SoC，AMD 占到了 30.9%，而去年第三季度只有 25%。

Currently trending CVE - Hype Score: 7 - OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups. In versions prior to 7.13.0, all deployments of OAuth2 Proxy in front of applications that normalize ...

Currently trending CVE - Hype Score: 10 - gnark is a zero-knowledge proof system framework. In versions prior to 0.14.0, the Verify function in eddsa.go and ecdsa.go used the S value from a signature without asserting that 0 ≤ S < order, leading to a signature malleability vulnerability. Because gnark’s native EdDSA and ...

British automotive giant Jaguar Land Rover said a cyberattack caused a huge hit to its bottom line in the most recent quarter.

A new phishing campaign has emerged that weaponizes Microsoft Entra guest user invitations to deceive recipients into making phone calls to attackers posing as Microsoft support. The attack leverages a critical security gap in how Microsoft Entra communicates with external users, turning a legitimate collaboration feature into a delivery mechanism for sophisticated social engineering attacks. […]

The post Hackers Leverages Microsoft Entra Tenant Invitations to Launch TOAD Attacks appeared first on Cyber Security News.

AI has changed how software gets built. For years, engineering teams treated code as the scarce resource. Writing it took time. Editing it took effort....Read More

The post Why Context Matters More Than Code in AI-Native Product Development appeared first on ISHIR | Custom Software Development Dallas Texas.

The post Why Context Matters More Than Code in AI-Native Product Development appeared first on Security Boulevard.

CISA has issued an urgent alert about a critical vulnerability in Fortinet’s FortiWeb Web Application Firewall (WAF), actively exploited by threat actors to seize administrative control of affected systems. Tracked as CVE-2025-64446, the flaw stems from a relative path traversal issue (CWE-23) that enables unauthenticated attackers to execute arbitrary administrative commands through specially crafted HTTP […]

The post CISA Warns of Fortinet FortiWeb WAF Vulnerability Exploited in the Wild to Gain Admin Access appeared first on Cyber Security News.