Search: “patch”

8 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 7753 Exploit / PoC 5646 Ransomware 3045 Malware 1374 Data breach 1243 Policy & legal 846 Threat actor 679 Phishing & fraud 313 Advisory 179 Industry 136 AI safety & security 94 Research 39 Tools 31 Model release 27

SeverityAll critical 15433 high 3138 medium 2481 low 133 info 269

Re: UnrealIRCd 6.2.7 released & hot-patch to fix security issues for existing installations

UnrealIRCd 6.2.7 hot-patch fixes a minor MITM command injection in STARTTLS S2S upgrade, flagged as LLM-reported.

Sam James points to an UnrealIRCd commit fixing a command injection during STARTTLS upgrade in server-to-server links, exploitable only via man-in-the-middle position. He characterizes it as uninteresting and cites it as an example of the typical shape of LLM-reported vulnerability findings.

oss-securitySep 13, 01:10 UTC · 3d agoVulnerability 2 sources1

3 Vulnerabilities Found on AvertX IP Cameras

Unit 42 disclosed three vulnerabilities (CVE-2020-11623/4/5) in AvertX HD838 and 438IR IP cameras; AvertX has released patches.

Palo Alto Networks Unit 42 researchers found three vulnerabilities in AvertX HD838 and 438IR outdoor surveillance cameras, which are rebranded Hikvision products: CVE-2020-11625 (user enumeration), CVE-2020-11624 (weak password requirements), and CVE-2020-11623 (exposed dangerous method/function). User enumeration responses facilitate brute-force attacks, the default admin credentials (admin/1234) are never enforced to change, and physical access to an exposed UART interface allows bootloader access and configuration modification. AvertX released a patch, removed the UART connector, and disabled the interface in the latest production batch.

Palo Alto Unit 42Aug 18, 04:45 UTC · 29d agoVulnerability CVE-2020-11625 CVE-2020-11624 CVE-2020-11623

Microsoft Excel KB5002914 update breaks copy and paste for some users

Microsoft's September Patch Tuesday update KB5002914 breaks copy-and-paste and formula dragging in Excel 2016 through 2024; uninstalling the update restores functionality.

Users on Reddit and Microsoft Q&A report that the KB5002914 security update shipped in the September 2026 Patch Tuesday breaks copy-and-paste, autofill, and formula dragging in Excel. The problem spans Office 2016 through 2024 across MSI and Click-to-Run installations, including Office LTSC Standard 2021, with some teams blocked after widespread patching. Uninstalling KB5002914 or downgrading the Office build restores functionality, though replacing the excel.exe binary is not recommended. BleepingComputer could not reproduce the issue on Excel 2019 Version 2508 Build 19127.20302 and contacted Microsoft for comment.

BleepingComputerupdated Sep 15, 09:25 UTC · 1d agofirst Sep 10, 19:07 UTC · 5d agoVulnerability 3 sources

[vim-security] Ex Command Injection in sign_jump() in Vim < v9.2.1090

Vim sign_jump() before v9.2.1090 permits Ex command injection via unescaped buffer names; low-severity patch disclosed by Christian Brabandt.

Christian Brabandt disclosed an Ex command injection vulnerability in Vim's sign_jump() function affecting versions before v9.2.1090, caused by improper neutralization of unescaped buffer names. The issue is rated Low severity and maps to CWE-88 (argument injection) and CWE-94 (code injection). A CVE has been requested but not yet assigned.

oss-securitySep 12, 17:53 UTC · 3d agoVulnerability

VU#369611: ExLlamaV3 contains Denial of Service vulnerability via insufficient bounds checking on kernel dispatch index

CERT/CC details CVE-2026-84286, an out-of-bounds memory access in ExLlamaV3's CUDA extension causing denial-of-service crashes; fixed via merged pull request.

CERT/CC published VU#369611 for CVE-2026-84286, an out-of-bounds memory access in the exllamav3_ext CUDA extension of the ExLlamaV3 LLM inference library. A crafted input with kernel parameter K set to 0 produces a negative index into a fixed 24-entry kernel dispatch array, causing a CUDA illegal memory access and denial-of-service crashes. The vendor fixed the issue in the main repository via pull request #310, and maintainers of 49 downstream projects, including ezexl3 and MawDiscord, are advised to rebuild against the patched version. The issue was reported by Nathan Keys and impact is limited to crashes and instability, not code execution.

CERT/CC Vulnerability NotesSep 11, 20:11 UTC · 4d agoVulnerability CVE-2026-842861

Skullcandy Dime 3 Bluetooth Flaw Lets Nearby Attackers Hijack Audio and Microphone

CERT/CC disclosed VU#859658: Skullcandy Dime 3 earbuds on firmware 1.0.0.28 accept unauthenticated Bluetooth pairing, letting nearby attackers hijack audio and microphone.

Skullcandy Dime 3 wireless earbuds (model S2DCW, firmware 1.0.0.28) accept Bluetooth Classic BR/EDR pairing requests from unknown devices without the owner activating pairing mode, a flaw linked to CVE-2025-20701 in Airoha Bluetooth audio SDK implementations and tracked as VU#859658 by CERT/CC. Attackers within Bluetooth range who know the device address can bond via the NoInputNoOutput configuration, establish A2DP or HFP/HSP connections, disrupt the owner's active audio session, and potentially capture live microphone audio. Firmware 1.0.0.30 addresses the issue, but Dime 3 earbuds do not support firmware updates through the Skullcandy mobile app, leaving affected users without a known upgrade path.

GBHackersupdated Sep 11, 04:16 UTC · 5d agofirst Sep 10, 12:28 UTC · 6d agoVulnerability 3 sources CVE-2025-207011

VU#859658: Skullcandy Dime 3 wireless earbuds contain an unauthenticated Bluetooth pairing vulnerability

Skullcandy Dime 3 earbuds (CVE-2025-20701) accept Bluetooth pairings without owner consent, letting in-range attackers hijack audio or capture microphone; no firmware update path exists.

CERT/CC's VU#859658 describes CVE-2025-20701 in the Airoha Bluetooth audio SDK, present in Skullcandy Dime 3 (Model S2DCW) firmware 1.0.0.28. A direct Bluetooth Classic pairing request with no PIN or physical confirmation completes via NoInputNoOutput, adding the attacker's device as trusted. Attackers in radio range can hijack the A2DP audio session, access the Hands-Free/Headset profile, and capture live microphone audio. Firmware 1.0.0.30 contains the effective patch, but Skullcandy says the Dime 3 does not support app-based firmware updates, leaving existing units unpatchable.

CERT/CC Vulnerability NotesSep 8, 14:42 UTC · 7d agoVulnerability CVE-2025-20701

Jellyfin 12.0 security fixes arrive alongside the removal of legacy client logins

Jellyfin 12.0 ships security fixes for path traversal, first-run setup bypass, unsafe plugin names, and web client XSS, plus removal of legacy login paths.

Jellyfin 12.0 blocks requests built to reach files outside served folders, prevents setup-wizard re-runs on misconfigured servers, rejects unsafe plugin package names, and fixes web client cross-site scripting. The project published no CVE identifiers or severity ratings for the fixes. The release also drops legacy /emby/ and /mediabrowser/ endpoints, targets .NET 10, and breaks 10.11-era third-party plugins.

Help Net SecuritySep 8, 08:41 UTC · 8d agoVulnerability