Do Son Microsoft patches a high-severity Windows DWM flaw that allows low-level users to seize SYSTEM privileges via a rendering brush error. PoC availabe.
Vulnerability
A critical LPE (CVE-2025-14282) in Dropbear SSH allows users to gain root access via Unix socket forwarding. Impacting embedded Linux, it's fixed in v2025.89.
Linux Kernel io_uring UAF Flaw Used to Cheat BPF Verifier and Achieve Container Escape, PoC Releases
Linux Kernel io_uring UAF Flaw Used to Cheat BPF Verifier and Achieve Container Escape, PoC Releases
A high-severity UAF (CVE-2025-40364) in Linux io_uring allows root RCE. Researchers demonstrated two kill chains: cheating the BPF verifier and using Dirty Pagetables for container escape. Patch immediately.
A High-severity flaw in macOS PackageKit bypasses a previous fix. Exploiting the user's .zprofile file allows a local attacker to easily gain root privileges.
The BlueShrimp exploit targets a Bluetooth UAF flaw (CVE-2025-48593, CVSS 8.0) that can crash the service on Android Automotive and Wear OS. Phones are safe, but PoC is public. Patch immediately.
A Critical (CVSS 9.3) LPE flaw in cPanel's Team Manager API allows a standard user to break out of their directory via path traversal and compromise the shared hosting server. Update immediately.
CVE-2025-60718 lets attackers hijack Windows Administrator Protection to gain full control. Learn how the "Shadow Admin" exploit works.
CVE-2025-54918 allows attackers to gain SYSTEM privileges on Windows Server 2025 via a new NTLM relay attack that bypasses LDAP Channel Binding. Patch now.
Critical Flowise Flaw Allows Unauthenticated Remote Admin Takeover via Exposed Registration Endpoint
Critical Flowise Flaw Allows Unauthenticated Remote Admin Takeover via Exposed Registration Endpoint
The team behind Flowise—a popular open-source platform for building AI agents and LLM workflows—has issued an urgent...
A High-severity LPE flaw (CVE-2025-60710) in the WindowsAI Recall Policy Configuration scheduled task allows local users to gain SYSTEM privileges via a symlink arbitrary delete attack.
Zimbra fixes Critical Stored XSS and an Unauthenticated LFI flaw, urging users to update immediately to mitigate session hijacking and data exfiltration risks.
Dell patched seven flaws in CloudLink, including two Critical bugs that allow an authenticated user to escape the restricted shell and execute arbitrary commands for system takeover. Update to v8.2.
A serious Windows LPE flaw in DirectComposition allows local attackers to gain SYSTEM privileges by exploiting a type confusion bug leading to a controlled out-of-bounds write in kernel memory.
A Critical Heap Overflow in strongSwan's EAP-MSCHAPv2 plugin allows Remote Code Execution on the client. An integer underflow in Failure Request packet processing causes memory corruption.
Ubiquiti issued an urgent patch for a Critical Auth Bypass flaw in UniFi Access. Attackers with network access can fully take over door management systems.
A Windows Agere Modem EoP flaw (CVE-2025-24990) under active exploit allowed arbitrary kernel R/W even when unused. Microsoft removed the driver in the October update. PoC is available.
Google Project Zero disclosed a zero-click RCE flaw (CVE-2025-54957, CVSS 7.0) in Dolby's Audio Decoder. The integer overflow can be triggered by a single audio file and affects Android, iOS, and macOS.
A new Zero-Click NTLM leak bypasses Microsoft's LNK patch, allowing unauthenticated NTLM hash theft on patched systems. The PoC works by exploiting UNC paths and the default shell32.dll icon reference.
A UAF flaw in the Linux kernel TLS subsystem allows a low-privileged user to gain RCE by exploiting memory corruption during asynchronous decryption.
Esri released a patch for a Critical (CVSS 10.0) SQL Injection flaw in ArcGIS Server v11.3, 11.4, and 11.5 that allows RCE and data access. Update immediately.
A critical UAF flaw in the Linux Traffic Control subsystem (CVE-2023-4921, CVSS 7.8) allows local privilege escalation to root. A fully detailed PoC exploit has been released.
A Critical flaw (CVE-2025-11230) in HAProxy’s mjson number parser allows unauthenticated attackers to cause a Denial of Service with a single crafted JSON payload. Update immediately.