Do Son Critical (CVSS 10) unpatched flaw in TI WooCommerce Wishlist allows unauthenticated RCE via file upload. Affects 100K+ sites.
Vulnerability
Exploit BadSuccessor to take over domains with PoC code. No patch, full AD compromise via dMSAs in Windows Server 2025.
New CrossPUSH & CrossSXG attacks exploit HTTP/2 and SXG to bypass Same-Origin Policy, enabling XSS and cookie manipulation.
New research reveals a high-severity mesh Wi-Fi vulnerability (CVSS 9.1) enabling frame injection even without credentials. PoC available.
GIMP versions before 2.99.16 & 3.0.0 are vulnerable to RCE from crafted image files. Patch now to protect your system.
A high-severity Siemens SiPass flaw allows unauthenticated remote attackers to cause a denial-of-service condition. Update to V2.95.3.18.
A critical flaw (CVE-2025-35003) in Apache NuttX RTOS allows RCE or DoS via crafted Bluetooth packets. Update to version 12.9.0 now.
A critical Canon printer vulnerability (CVE-2025-2146, CVSS 9.8) allows network attackers to execute arbitrary code. Update firmware now.
A critical pre-authentication RCE vulnerability in vBulletin 5.x and 6.x allows full server compromise. A PoC exploit is available.
A critical WSO2 vulnerability (CVE-2024-6914, CVSS 9.8) allows unauthenticated account takeover via a SOAP service, including admin access.
A high-severity vulnerability (CVSS 9.4) in Sony SNC-series cameras allows remote admin access due to hard-coded default credentials. PoC exists.
An unauthenticated flaw in GNOME's remote desktop (CVE-2025-5024) allows attackers to repeatedly crash Linux environments, preventing recovery even after systemd restarts.
A Ghostscript vulnerability (CVE-2025-48708) embeds plaintext passwords in encrypted PDF files, undermining document security. Update now!
ABB's ASPECT BMS has 32 security flaws, with some critical RCE and privilege escalation vulnerabilities having no planned fixes for legacy systems.
Critical NETGEAR flaw (CVE-2025-4978) allows full admin access via hidden backdoor. Exploit details and PoC analysis inside.
Canon urges users to mitigate high-severity flaws in a range of printers that could allow sensitive data extraction.
A high-severity flaw (CVE-2025-47947) in ModSecurity's Apache module allows DoS via JSON. PoC exists, no workaround, and a patch is expected soon.
A critical zero-day (CVE-2025-4428) in Ivanti EPMM is exploited by UNC5221, enabling unauthenticated RCE and data theft across multiple sectors.
Cisco patches two privilege escalation flaws in Unified Intelligence Center that could expose sensitive data. Users urged to upgrade immediately.
A high-severity flaw (CVE-2025-48026) in Mitel OpenScape Xpressions allows unauthenticated attackers to read sensitive local files, including voicemail.
Google Chrome released an update with 8 security fixes, including a high-severity use-after-free vulnerability (CVE-2025-5063). Update your browser now!
ProjectDiscovery revealed critical zero-days (CVSS 10) in Versa Concerto, enabling full RCE and host compromise via auth bypass and Docker escape.