Vendor Response The vendor has released a patch for Windows that addresses this vulnerability: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55681 CVE CVE-2025-55681 Credit The vulnerability was disclosed during our TyphoonPWN Windows category and won second place. Vulnerability Details The bug
Vendor Response The vendor has released a patch for Windows that addresses this vulnerability: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55680 CVE CVE-2025-55680 Credit The vulnerability was disclosed during our TyphoonPWN Windows category and won first place. Vulnerability Details A vulnerability
Affected Versions Vendor Response The vendor has released an updated kernel on the 18th of September Credit The vulnerability was disclosed during our TyphoonPWN 2025 Linux category and won first place. Vulnerability Details The vulnerability
Background vsock (short for Virtual Socket) is a communication mechanism in the Linux kernel designed to enable efficient, low-latency communication between virtual machines (VMs) and their host system, or between VMs themselves, without relying on traditional
Affected Version CanonicalEquality::EqualValueType nullity check bug All Chrome builds having the ValueType refactoring commit 44171ac – M135 and above in stable channel. Prior to the commit, CanonicalEquality::EqualValueType() had a ValueKind check that enforces nullity equivalence
Affected Versions Vendor Response The vendor has issued an advisory SMR-SEP-2025, available at: https://lgsecurity.lge.com/bulletins/tv in regard to the below described vulnerability Credit The vulnerability was disclosed during our TyphoonPWN 2025 LG Category and won first
Affected Versions Vendor Response Linux kernel release the patch (https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35f56c554eb1b56b77b3cf197a6b00922d49033d) Background The ipset subsystem in the Linux kernel is a framework used for efficiently managing sets of IP addresses, networks, and port numbers for high-performance
Introduction WebAssembly extends the native code surface of Chrome in ways that are both powerful and risky. Unlike JavaScript, WASM modules are compiled directly into machine code via a streamlined pipeline, bypassing many of the
Summary A critical double free vulnerability in the pipapo set module of the Linux kernel’s NFT subsystem has been discovered. An unprivileged attacker can exploit this vulnerability by sending a specially crafted netlink message, triggering
Summary An analysis primarily of Kerio Control revealed a design flaw in the implementation of the communication with GFI AppManager, leading to an authentication bypass vulnerability in the product under audit. Once the authentication bypass
Summary The analysis conducted on the product: ISPConfig version: 3.2 build: 12p1 was carried out using the official installation package. The analysis identified primarily design flaws in the user creation/edit functionality, which allow a client
Summary Multiple Foscam X5 vulnerabilities have been discovered, the vulnerabilities allow a remote attacker to trigger code execution vulnerabilities in the product. Credit An independent security researcher working with SSD Secure Disclosure. Vendor Response Repeated
