Do Son A critical flaw in Fabio load balancer allows malicious clients to manipulate or strip HTTP headers, leading to potential access control bypass. Upgrade to 1.6.6.
Vulnerability
Veritas DLO has critical vulnerabilities (CVE-2024-38475, CVE-2025-24813) in bundled Apache components, leading to RCE. Upgrade immediately to prevent exploitation.
Netwrix warns of critical 10.0 CVSS flaws in Directory Manager v11, including a hard-coded password. Patch immediately to prevent unauthorized access and data breaches.
A low-severity flaw in Apache Tomcat (CVE-2025-46701) allows security constraint bypass via crafted URLs on case-insensitive file systems. Update now!
A critical Spring Cloud Gateway flaw allows header spoofing from untrusted proxies. Update to fix or disable forwarding.
A critical IBM Tivoli Monitoring flaw (CVSS 9.8) allows remote arbitrary code execution due to improper array validation. Update now.
A ZITADEL vulnerability allows host header injection to hijack user accounts via password reset links. Update to 3.2.2+ or configure proxy.
A critical Icinga 2 vulnerability (CVSS 9.3) allows malicious certificate impersonation, affecting builds with older OpenSSL. Update now!
ISC uncovers security flaws in its Kea DHCP server, including privilege escalation and data leakage. Update to Kea 2.4.2, 2.6.3, or 2.7.9 immediately.
A critical Mitsubishi MELSEC iQ-F Series CPU module flaw allows remote DoS and info leak. No software patch available.
A critical Tenda W18Ev2 router flaw allows unauthenticated RCE via admin password change. PoC available, no patch yet.
A critical XSS vulnerability (CVSS 9.1) in Argo CD allows attackers to hijack user sessions and control Kubernetes resources. Update to fix
Redis versions 7.0+ are vulnerable to RCE via a stack buffer overflow in redis-check-aof. Update to 8.0.2, 7.4.4, or 7.2.9.
Java applications face a critical risk! A flaw in Apache Commons BeanUtils (CVSS 8.8) can lead to arbitrary code execution. Update immediately.
Citrix has patched high-severity flaws in XenServer VM Tools for Windows that could allow attackers to compromise guest VMs. Update to version 9.4.1.
A critical Cyrus IMAP vulnerability (CVSS 9.8) on openSUSE allows unprivileged users to gain root access, risking full system compromise.
Amazon Redshift Python Connector has a high severity vulnerability allowing OAuth2 token interception due to missing SSL validation.
A critical Firefox vulnerability in libvpx allows remote code execution without user interaction beyond normal Browse. Update immediately!
Google Chrome 137 is out, patching 11 vulnerabilities including high-severity use-after-free (CVE-2025-5063) and V8 flaws. Update now!
Critical flaws (CVSS 9.8) in Weidmueller industrial switches allow unauthenticated remote attackers full system compromise. Update firmware.
A critical GitHub MCP server vulnerability allows AI agent hijacking via prompt injection, leading to data exfiltration from private repositories.
Lenze VPN Client for x500 IoT gateways has critical flaws allowing arbitrary code execution via local privilege escalation.