2 CVEs published in the last four months and 5 stories. Exploited flaws first.
| CVE | CVSS | Severity | Product | Summary | Published |
|---|---|---|---|---|---|
| CVE-2026-49121 | 8.1 | high | aiter | AI Tensor Engine for ROCm (AITER) through 0.1.14 contains an unauthenticated remote code execution vulnerability i | 134d ago |
| CVE-2024-36333 | 7.8 | high | radeon software | A DLL hijacking vulnerability in the AMD Cleanup Utility could allow an attacker to achieve privilege escalation p | 152d ago |
Researchers from MIT have unveiled a new speculative execution attack, dubbed TONTOU (Time-of-Neutralization to Time-of-Use), that circumvents existing defenses against Spectre v2. The attack, developed by Daniël Trujillo and Mengjia Yan of MIT's Computer Science and Artificial Intelligence Laboratory (CSAIL), exploits a brief window between when branch predictor states are neutralized and…
Researchers at MIT CSAIL have reportedly discovered a novel interrupt injection attack, dubbed "INTERRUPT INJECTION," capable of bypassing existing Spectre v2 defenses on both Intel and AMD CPUs. The technique allows an unprivileged Linux program to exploit a timing window, effectively re-poisoning a processor's branch predictor after the system's mitigations have already executed.
A newly disclosed vulnerability in the Linux kernel, named Januscape, allows an attacker to escape a virtual machine and execute code on the host system. The flaw, present for approximately 16 years before being patched in June 2026, stems from a use-after-free weakness within the shadow MMU emulation of KVM/x86, the virtualization technology for Intel and AMD processors.
A critical vulnerability, present in the Linux kernel's KVM (Kernel-based Virtual Machine) hypervisor for 16 years, has been disclosed, potentially allowing attackers to escape virtual machine environments and execute code on the host system. The flaw, named Januscape, impacts systems utilizing processors from both Intel and AMD.
A critical vulnerability discovered in the Linux Kernel-based Virtual Machine (KVM) hypervisor could allow a malicious actor within a guest virtual machine to escape to the host system. The flaw, identified as CVE-2026-53359 and nicknamed "Januscape," affects the shadow memory management unit (MMU) component of KVM.