Data Privacy & Cybersecurity

Global Privacy Assembly Adopts Resolution on Trustworthy International Data Traffic

The Global Privacy Assembly (GPA) adopted a resolution on trustworthy international data traffic, also known as Data Free Flow with Trust (DFFT). Initiated by the German delegation, the resolution provides core data protection elements to guide legal frameworks and transfer instruments for secure data transfers.

BfDI Welcomes EDPB GDPR Guidelines on Legitimate Interest

The European Data Protection Board (EDPB) has released draft guidelines on the processing of personal data based on legitimate interest under GDPR. The German Federal Commissioner for Data Protection and Freedom of Information (BfDI) welcomes the initiative to provide greater legal certainty. The guidelines are now open for public consultation.

NetBox Cross-Site Scripting Vulnerability Advisory

CERT-Bund has issued a security advisory for NetBox, detailing a vulnerability that allows for Cross-Site Scripting attacks. The advisory affects NetBox version 4.3.5 and provides information on mitigation strategies.

Gitea Vulnerabilities Allow Bypass, Data Manipulation, Disclosure

CERT-Bund has issued a security advisory for Gitea, detailing multiple vulnerabilities with a CVSS base score of 7.3. These vulnerabilities can allow attackers to bypass security measures, manipulate data, and disclose confidential information. Users are advised to update to Gitea version 1.25.5 or later.

Kubernetes Vulnerability Allows Remote File Manipulation

CERT-Bund has issued a security advisory (WID-SEC-2026-0738) regarding a vulnerability in Kubernetes that allows remote authenticated attackers to manipulate files. The vulnerability affects the Open Source Kubernetes CSI Driver for NFS versions prior to 4.13.1 and has a CVSS Base Score of 6.5.

libexif Vulnerability Allows Code Execution and Denial-of-Service

CERT-Bund has issued a security advisory regarding a vulnerability in the libexif library (versions <=0.6.25). The vulnerability allows local attackers to execute arbitrary code, cause a denial-of-service, or disclose confidential information. Mitigation is available.

FFmpeg Vulnerability Allows Denial of Service and Information Disclosure

CERT-Bund has issued a security advisory (WID-SEC-2026-0740) regarding a vulnerability in the FFmpeg RV60 video decoder. The vulnerability allows remote attackers to cause a Denial of Service or disclose information. Affected versions include Open Source ffmpeg <8.1, 8.0, and 8.0.1.

CPython Vulnerabilities Allow File Manipulation and DoS

CERT-Bund has issued a security advisory regarding multiple vulnerabilities in CPython versions prior to 3.15.0. These vulnerabilities can be exploited by authenticated remote attackers to manipulate files or cause a denial-of-service condition. The advisory provides mitigation information for affected systems.

Octopus Deploy Vulnerability Allows Remote File Manipulation

CERT-Bund has issued a security advisory for Octopus Deploy, detailing a vulnerability that allows remote authenticated attackers to manipulate files. The advisory affects specific versions of Octopus Deploy running on Linux and Windows and provides mitigation information.

OpenClaw AI Assistant Vulnerabilities

CERT-Bund has issued a security advisory for OpenClaw, an AI assistant, detailing multiple vulnerabilities with a high CVSS base score of 8.1. The advisory urges users to mitigate the risks associated with privilege escalation and confidential information disclosure.