Do Son Ubiquiti warns of critical RCE flaw in UniFi Protect Cameras (CVE-2025-23123); update firmware and app to prevent potential network compromise.
Vulnerability
A vulnerability in Apache ActiveMQ's buffer handling can cause memory exhaustion, leading to denial of service. Patch now to version 6.1.6+ or 5.19.0+.
IGEL OS suffers from a critical privilege escalation vulnerability affecting OS 11 and OS 12. Users are urged to patch immediately.
A zero-day privilege escalation vulnerability (CVE-2025-29824) in Microsoft CLFS was exploited by Balloonfly (Play ransomware) before the official patch.
A critical vulnerability in Kibana (CVE-2025-25014) enables arbitrary code execution via prototype pollution. Elastic urges users to patch immediately.
Akamai uncovers active exploitation of retired GeoVision IoT devices via CVE-2024-6047 and CVE-2024-11120 using Mirai-based botnet LZRD.
CVE-2025-46728 in cpp-httplib allows memory exhaustion via chunked requests. Patch to v0.20.1 to prevent denial-of-service attacks.
CVE-2025-47241 in Browser Use lets attackers bypass whitelists via crafted URLs. Upgrade to v0.1.45 to secure AI-driven browser automation.
OpenCTI flaw CVE-2025-24977 allows RCE and secret exposure via webhooks. Patch to v6.4.11 to protect Docker/Kubernetes deployments.
Critical security vulnerability (CVE-2025-4318) in AWS Amplify Studio allows arbitrary code execution. Upgrade to version 2.20.3 immediately!
A critical security flaw in the OttoKit WordPress plugin (100,000+ installs) is under active exploit. Update immediately to prevent website compromise.
A preauth DoS flaw in Windows Deployment Services allows attackers to crash systems via spoofed UDP packets, warns researcher Zhiniang Peng.
A critical XXE vulnerability (CVE-2025-2905) in WSO2 API Manager allows attackers to read files and cause DoS. Patch WSO2-2016-0151 is the solution.
A critical vulnerability (CVE-2025-2605) in Honeywell MB-Secure alarm panels allows attackers to execute OS commands. Update to the latest version now.
CERT/CC warns of CVE-2025-3927 in Digigram PYKO-OUT AoIP device, where default no-password access allows attackers to control devices and pivot networks.
IBM patches CVE-2024-51466 and CVE-2024-40695 in Cognos Analytics to prevent system compromise, sensitive data leaks, and remote code execution.
Android Security Bulletin May 2025 addresses critical vulnerabilities, including actively exploited CVE-2025-27363 in FreeType. Update your devices now!
CISA alerts to active exploitation of CVE-2025-3248 in Langflow. Unauthenticated RCE vulnerability poses high risk. Upgrade to 1.3.0 immediately.
CVE-2024-7399 vulnerability actively exploited in Samsung MagicINFO 9 Server allows remote code execution. Arctic Wolf reports in-the-wild attacks. Upgrade now!
CVE-2025-0217 flaw in BeyondTrust PRA allows session hijacking via local auth bypass. Upgrade to version 25.1+ to prevent exploitation.
MediaTek’s May 2025 bulletin reveals high-severity modem flaw CVE-2025-20666 & Android bugs risking denial of service & local privilege escalation
CVE-2025-46762 in Apache Parquet Java enables code execution via malicious Avro schema metadata. Upgrade to 1.15.2 or harden deserialization settings.