-
CVE-2025-14372: Use after free in Password Manager.
My originally scheduled for release on December 15, 2025, it was released ahead of schedule! Stable Channel Update for Desktop – Wednesday, December 10, 2025 Preface: About Google browser (The Storage Architecture): A Database, Not Just a Flat File . Chrome stores login data, including usernames, the website URL, and the encrypted password, in a…
-
CVE-2025-9612/9613/9614: AMD is concerned that a defect in non-AMD PCIe IDE could affect certain AMD products. (12th Dec 2025)
Preface: The security concerns regarding data integrity in Peripheral Component Interconnect Express (PCIe) transactions are a critical aspect of modern computing, particularly in data centers, cloud environments, and automotive systems where sensitive information is routinely handled. Historically, PCIe interfaces were considered relatively secure due to their placement inside a server enclosure, but the rise of…
-
CVE-2025-66471: Be vigilant with Python-based Kubernetes clients! (11th Dec 2025)
NVD Last Modified: 12/08/2025 Preface: urllib3 is extremely popular and foundational in the Python ecosystem, acting as a core dependency for many top libraries like requests, pip, and kubernetes, though it’s often used indirectly through the more user-friendly requests library for general tasks. It’s a robust, low-level HTTP client known for features like connection pooling…
-
CVE-2025-33201 and CVE-2025-33211: About NVIDIA Triton Inference Server 10th Dec 2025
Initial release – 02 December 2025 Preface: Triton Inference Server is an open source inference serving software that streamlines AI inferencing. Triton Inference Server enables teams to deploy any AI model from multiple deep learning and machine learning frameworks, including TensorRT, PyTorch, ONNX, OpenVINO, Python, RAPIDS FIL, and more. Background: The NVIDIA Triton Inference Server…
-
CVE-2025-33208: NVIDIA TAO design weakness (9th Dec 2025)
Official Updated 11/26/2025 Preface: AI vision models are artificial intelligence systems, often multimodal (Vision-Language Models or VLMs), that analyze and interpret visual data (images, videos) alongside text, enabling them to “see” and understand the world like humans, performing tasks from object recognition and image captioning to answering questions about visuals and generating new images, by…
-
A Tale of Two GPU’s
Story background: Rowhammer Attacks on GPU Memories are Practical (8th Dec 2025) Preface: The story unfolds a hidden tale within two different design purpose GPUs (consumer display card and AI (install ROCm)) and reveals the untold behind-the-scenes story that the two sides concealed from the recent. Background: AMD’s bulletin (Dec 2025) confirms GDDR6-based GPUs are…
-
CVE-2025-47372: Buffer Copy Without Checking Size of Input in Boot (5th Dec-2025)
Qualcomm – Official announcement: 1st Dec 2025 Quote: I chose a Qualcomm product affected by this vulnerability as an example. The Snapdragon Ride™ Flex SoC, including the SA9000P series, does not run on a single embedded OS, but rather supports mixed-criticality operating systems such as those provided by Qualcomm’s partners or the automaker themselves. Preface:…
-
CVE-2025-47319: Exposure of Sensitive System Information to an Unauthorized Control Sphere in HLOS (4th Dec 2025)
Published: 12/01/2025 Preface: Qualcomm HLOS (High-Level Operating System) refers to the operating system layer, like Android, that runs on a Qualcomm Snapdragon chipset and is responsible for general device functionality. “TA” (Trusted Application) is a component of the Qualcomm Trusted Execution Environment (QTEE) that runs in a secure environment, separate from the HLOS. Security issues…
-
CVE-2025-66216: About AIS-catcher (3rd Dec 2025)
Preface: AIS-Catcher is a MIT licensed dual band AIS receiver for Linux, Windows and Raspberry Pi. It is compatible with RTL-SDR dongles and the Airspy HF+. AIS stands for Automatic Identification System and is used by marine vessels to broadcast their GPS locations in order to help avoid collisions and aide with rescues. An RTL-SDR…
-
CVE-2025-12183: About official lz4-java library (2nd Dec 2025)
Published: 2025-11-28 Preface: Apache Hadoop and Apache Spark are both prominent and widely used frameworks for big data analytics. They are central to the processing and analysis of large datasets that cannot be handled by traditional data processing tools. Apache Hadoop utilizes the MapReduce programming model as a core component for processing and analyzing large…