Do Son Joomla has released security patches for critical SQL injection (CVE-2025-25226) and MFA bypass (CVE-2025-25227) vulnerabilities. Learn how to protect your Joomla site with urgent updates.
Vulnerability
Cloud Software Group addresses critical code execution and data function vulnerabilities (CVE-2025-3114, CVE-2025-3115) in Spotfire products. Upgrade to the latest version to mitigate risks.
Microsoft integrates AMSI with Exchange and SharePoint Server to enhance security against attacks like SSRF and web shell deployment, protecting against sophisticated threats.
Arista Networks addresses a critical vulnerability (CVE-2024-12378) in EOS that can cause cleartext transmission of sensitive data. Upgrade to a patched version to secure Vxlan tunnels.
A critical use-after-free vulnerability (CVE-2025-31498) has been discovered and patched in the c-ares DNS library. Update to version 1.34.5 to mitigate potential risks.
SonicWall has patched three vulnerabilities (CVE-2025-23008, CVE-2025-23009, CVE-2025-23010) in its NetExtender VPN client. Update to version 10.3.2 or later to prevent privilege escalation and unauthorized access.
CISA has added Linux kernel vulnerabilities CVE-2024-53197 and CVE-2024-53150 to its KEV catalog, warning of active exploitation. Learn how these flaws are used in Android device exploits and what steps to take.
Research reveals Cisco CVE-2018-0171, a 7-year-old Smart Install RCE vulnerability, remains active, exposing over 1,200 devices. Learn how attackers exploit it and how to protect your network.
A critical vulnerability (CVE-2025-3102) in the SureTriggers WordPress plugin allows unauthenticated admin account creation, potentially exposing over 100,000 sites to full takeover. Update to version 1.0.79 immediately.
Dell has released a security advisory addressing vulnerabilities in PowerScale OneFS, including potential for takeover of privileged accounts and denial of service. Upgrade information and workarounds are provided.
A security vulnerability (CVE-2025-30215) in NATS Server allows unauthorized actions on JetStream assets due to missing access controls.
A critical SSRF vulnerability (CVE-2025-32013) has been patched in LNbits, the Lightning Network wallet server. Learn how attackers could exploit LNURL authentication to access internal services and how to protect your systems.
A high-severity XXE vulnerability (CVE-2025-32406) has been discovered in NAKIVO Backup & Replication, allowing potential unauthorized access to sensitive data. Users are urged to upgrade to the latest version.
Invariant Labs reveals a critical vulnerability in the Model Context Protocol (MCP) enabling Tool Poisoning Attacks. Learn how this threat can lead to data exfiltration and AI hijacking
CISA has added critical vulnerabilities affecting Windows CLFS (CVE-2025-29824) and Gladinet CentreStack (CVE-2025-30406) to its Known Exploited Vulnerabilities Catalog. Learn about the threats and the urgent need to apply patches.Sources and related content
Microsoft reports active exploitation of a Windows CLFS zero-day (CVE-2025-29824) to escalate privileges and deploy ransomware. Learn about the attacks, the threat actors involved, and how to mitigate the risk.
Siemens ProductCERT issued a security advisory detailing critical vulnerabilities in the SENTRON 7KT PAC1260 Data Manager. The flaws could allow remote attackers to execute code, bypass authentication, and more.
A vulnerability (CVE-2024-12556) in Kibana allows code injection via prototype pollution, file upload, and path traversal. Upgrade to the latest version or disable the integration assistant to mitigate this high-severity security risk.
The latest Chrome update addresses a high-severity "use after free" vulnerability in Site Isolation (CVE-2025-3066). Learn about the security risk and the importance of updating your Chrome browser
Microsoft's April 2025 Patch Tuesday addresses 134 vulnerabilities, including a zero-day under active exploitation. This update covers critical RCE flaws in Windows, Office, and more
JPCERT/CC reports multiple vulnerabilities in Inaba Denki Sangyo Wi-Fi AP units, including command injection and authentication issues
A security flaw in Apache's mod_auth_openidc module can expose protected web content to unauthenticated users. Patch or mitigate to secure your server