-
CVE-2025-68493: Apache Struts recently released a security advisory recommending that you check your code and upgrade. Otherwise, the new version of Struts will refuse to execute any existing code that contains security vulnerabilities. (14th Jan 2026)
Preface: Many large, enterprise-level companies across various industries use or have used the open-source Apache Struts framework for building Java web applications. Companies using this framework must ensure they are on a currently supported version and apply security patches immediately. Background: The Model-View-Controller (MVC) is a software architectural pattern used in Java and other programming…
-
CVE-2025-47393: In Qualcomm-specified products, memory corruption occurs when the core driver accesses resources. 13th Jan-2026
Qualcomm – Official announcement: 1st Jan 2026 Preface: The Qualcomm Snapdragon Ride platform is used to develop advanced driver assistance systems (ADAS) and autonomous driving (AD) for vehicles. It combines powerful hardware (SoCs containing AI, GPUs, and vision engines) and software (SDKs, cloud tools) to support a wide range of functions from basic safety features…
-
CVE-2025-47345: About Qualcomm – Reusing a Nonce, Key Pair in Encryption in Automotive Platform (12th Jan 2026)
Official published: 5th JAN 2026 Preface: When used in an automotive context, the Snapdragon 8 Gen 3 Mobile Platform—and its dedicated automotive counterparts—utilize a High-Level Operating System (HLOS). While the “Mobile Platform” is a consumer-grade chip typically found in smartphones, some automakers have integrated it directly into vehicles. For purpose-built automotive solutions, Qualcomm offers the…
-
Maven orbiter, where are you? (10th Jan, 2026)
Preface: As of January 10, 2026, NASA has lost contact with the MAVEN spacecraft, and recovery efforts are currently paused due to an astronomical phenomenon known as solar conjunction. Background: NASA’s MAVEN orbiter uses an Electra UHF transceiver to act as a crucial “bent pipe” communication relay, receiving data from rovers and landers on Mars…
-
CVE-2025-47339 – Memory corruption while deinitializing a HDCP session -Use After Free in HLOS (9th Jan 2026)
Official Published: 01/05/2026 Preface: In Qualcomm devices, the Host Operating System (HLOS), often Android/Linux, manages HDCP (High-bandwidth Digital Content Protection) sessions by interacting with dedicated hardware/firmware (DCP/ MediaLink/TrustZone) for key exchange and encryption, ensuring protected content (DRM) is output securely over HDMI/DisplayPort, with the HLOS kernel handling driver calls and security enforcement to prevent playback…
-
CVE-2026-21675 Linux systems using the IccProfLib library are also affected by this vulnerability! (8 Jan 2026)
Published: 2026-01-05 Preface: Website hosting itself does not “provide” ICC profiles; instead, it stores the image files you upload, which may contain embedded ICC profiles. However, the key is how web browsers interpret them. Most standard browsers default to or prioritize the sRGB color space for displaying web page content, so explicit ICC profiles are…
-
CVE-2026-21452: About MessagePack for Java (7th Jan 2026)
Preface: Aerospike is a specific, high-performance NoSQL database, and benchmarks generally show it to be significantly faster than many other clustered NoSQL solutions like Cassandra and MongoDB. The term “NoSQL” refers to a broad category of databases with varying performance characteristics, so a direct comparison is more nuanced than a simple yes/no answer. Aerospike uses…
-
CVE-2026-21440: Regarding the AdonisJS vulnerability, companies are advised to be vigilant! (January 6, 2026)
Preface: Multiple fashion brands experienced significant cyber attacks and data breaches in 2025, with many incidents linked to third-party vendor vulnerabilities and attributed to hacking groups. Louis Vuitton (LVMH Group): Confirmed a global cyber attack in July 2025 that compromised customer data in the UK, South Korea, Turkey, Italy, and Sweden. The data exposed included…
-
CVE-2025-68620: Signal K Server, no authentication is required, and authentication can be completely bypassed. (5th Jan 2026)
NVD Published Date: 01/01/2026 Preface: Signal K’s popularity in the IoT space, especially in marine tech, is growing due to its open-source nature, enabling advanced, connected, and personalized vessel data systems, integrating with trends like AI, edge computing (via Meshtastic), and edge devices for remote monitoring and control, mirroring the broader IoT boom expected to…
-
The Linux kernel CVE-2023-54324 was released on December 30, 2025. Do you think that is valuable to know? (2nd Jan 2026)
Preface: Essentially, when security experts read vulnerability lists, the priority is time-dependent. For example, if you read a CVE reference document on January 2, 2025, but the document’s starting date is 2023, there’s a 99% chance you’ll ignore it. This makes sense, after all, it’s two years ago. According to vendor practice, when patches are…