Vulnerability

Linux Kernel Flaw: Root Privilege Escalation Via Use-After-Free, PoC Available!

• Vulnerability

Linux Kernel Flaw: Root Privilege Escalation Via Use-After-Free, PoC Available!

Do Son July 14, 2025 0

A kernel-level UAF flaw (CVE-2025-38001) in Linux HFSC/NETEM allows root privilege escalation via RBTree manipulation. PoC available. Update now!

Juniper Security Director Alert: Critical Flaw Allows Unauthenticated Access to Sensitive Resources

• Vulnerability

Juniper Security Director Alert: Critical Flaw Allows Unauthenticated Access to Sensitive Resources

Do Son July 11, 2025 0

Juniper warns of a critical flaw (CVE-2025-52950, CVSS 9.6) in Security Director 24.4.1, allowing unauthenticated attackers to read or tamper with sensitive resources. Update immediately.

Windows Update Flaw: SYSTEM Privilege Escalation Via Arbitrary Folder Deletion, PoC Available!

• Vulnerability

Windows Update Flaw: SYSTEM Privilege Escalation Via Arbitrary Folder Deletion, PoC Available!

Do Son July 10, 2025 0

A Windows Update flaw (CVE-2025-48799) allows SYSTEM privilege escalation via arbitrary folder deletion using symlinks on multi-drive systems. PoC available. Patch now!

Hardcoded Credentials & Command Injection Found in HPE Aruba Instant On Access Points

• Vulnerability

Hardcoded Credentials & Command Injection Found in HPE Aruba Instant On Access Points

Do Son July 9, 2025 0

HPE Aruba warns of critical flaws in Instant On Access Points (CVE-2025-37103) allowing unauthenticated admin bypass via hardcoded credentials and authenticated command injection.

Apache Tomcat Patches Trio of Denial-of-Service Flaws

• Vulnerability

Apache Tomcat Patches Trio of Denial-of-Service Flaws

Do Son July 9, 2025 0

Apache Tomcat 9.0.107 patches three critical DoS flaws (CVE-2025-52434, CVE-2025-52520, CVE-2025-53506) that can disrupt web services via HTTP/2, file uploads, and excessive streams.

MongoDB Flaws Allow Privilege Escalation & DoS

• Vulnerability

MongoDB Flaws Allow Privilege Escalation & DoS

Do Son July 8, 2025 0

MongoDB has patched two flaws: CVE-2025-6713 (CVSS 7.7) allows privilege escalation via $mergeCursors, and CVE-2025-6714 (CVSS 7.5) causes mongos DoS.

Redis Vulnerability Opens Door to Remote Code Execution, PoC Releases

• Vulnerability

Redis Vulnerability Opens Door to Remote Code Execution, PoC Releases

Do Son July 7, 2025 0

A flaw (CVE-2025-48367, CVSS 7.0) in Redis HyperLogLog allows authenticated RCE via out-of-bounds writes. PoC available. Update to 8.0.3, 7.4.5, 7.2.10, or 6.2.19!

Urgent: Linux Kernel Flaw Allows Remote Crash, PoC Available!

• Vulnerability

Urgent: Linux Kernel Flaw Allows Remote Crash, PoC Available!

Do Son July 3, 2025 0

A NFSundown flaw (CVE-2025-38089) in the Linux kernel allows remote attackers to crash NFS servers via a NULL pointer dereference. PoC exploit is public!

Actively Exploited Google Chrome Zero-Day (CVE-2025-6554) Added to CISA’s KEV Catalog, PoC Available

• Vulnerability

Actively Exploited Google Chrome Zero-Day (CVE-2025-6554) Added to CISA’s KEV Catalog, PoC Available

Do Son July 3, 2025 0

Google has urgently patched a high-severity zero-day (CVE-2025-6554) in Chrome's V8 JavaScript engine. This type confusion flaw is actively exploited in the wild, risking RCE.

CVSS 9.8 RCE in Netflix Conductor Exposes Servers to Full Remote Shell – PoC Available

• Vulnerability

CVSS 9.8 RCE in Netflix Conductor Exposes Servers to Full Remote Shell – PoC Available

Do Son July 2, 2025 0

Critical CVSS 9.8 RCE in Netflix Conductor lets attackers gain remote shell via JavaScript injection. Exploit PoC available. Patch now!

Electron Flaws: ASAR Bypass & Buffer Overflow Threaten Desktop Apps

• Vulnerability

Electron Flaws: ASAR Bypass & Buffer Overflow Threaten Desktop Apps

Do Son July 1, 2025 2

Electron has critical flaws: CVE-2024-46993 allows RCE via image buffer overflow, and CVE-2024-46992 is an ASAR integrity bypass on Windows.

Critical Sunshine Flaw: Remote Command Execution via App-Wide CSRF

• Vulnerability

Critical Sunshine Flaw: Remote Command Execution via App-Wide CSRF

Do Son July 1, 2025 0

A critical CSRF flaw (CVE-2025-53095, CVSS 9.7) in Sunshine game streaming host allows remote attackers to execute arbitrary system commands with admin privileges.

D-Link Router Flaw Allows Remote Code Execution, PoC Publishes, NO PATCH

• Vulnerability

D-Link Router Flaw Allows Remote Code Execution, PoC Publishes, NO PATCH

Do Son June 30, 2025 0

A critical flaw (CVE-2025-6328) in D-Link's EOL DIR-815 router allows remote code execution via a stack-based buffer overflow. No patches will be issued.

MongoDB Hit by Pre-Auth Denial of Service Vulnerability

• Vulnerability

MongoDB Hit by Pre-Auth Denial of Service Vulnerability

Do Son June 27, 2025 0

MongoDB discloses CVE-2025-6710 (CVSS 7.5), a pre-authentication DoS flaw. Crafted JSON inputs can crash servers via stack overflow.

Privilege Escalation in guix-daemon: Critical Vulnerabilities Threaten Multi-User Systems

• Vulnerability

Privilege Escalation in guix-daemon: Critical Vulnerabilities Threaten Multi-User Systems

Do Son June 26, 2025 0

Two critical flaws (CVE-2025-46415, CVE-2025-46416) in guix-daemon allow local attackers to gain root access via socket exploitation and race conditions.

Pre-Auth Command Execution in CentOS Web Panel Exposes Over 200,000 Servers, PoC Publishes

• Vulnerability

Pre-Auth Command Execution in CentOS Web Panel Exposes Over 200,000 Servers, PoC Publishes

Do Son June 25, 2025 0

A critical flaw (CVE-2025-48703) in CentOS Web Panel allows unauthenticated RCE via authentication bypass and command injection, risking over 200,000 servers.

Behind the Commit: CVSS 10.0 Bug Lets Attackers Hijack Gogs Servers

• Vulnerability

Behind the Commit: CVSS 10.0 Bug Lets Attackers Hijack Gogs Servers

Do Son June 24, 2025 0

Two severe Gogs flaws: CVE-2024-56731 (CVSS 10.0) allows RCE via symlink exploit, and CVE-2025-47943 (CVSS 6.3) is a stored XSS in PDF.js.

Critical Key Derivation Flaws in pbkdf2 Affect Millions of JavaScript Projects, PoC Available

• Vulnerability

Critical Key Derivation Flaws in pbkdf2 Affect Millions of JavaScript Projects, PoC Available

Do Son June 24, 2025 0

Two critical flaws (CVE-2025-6545, CVE-2025-6547, CVSS 9.1) in pbkdf2 npm package allow silent compromise of cryptographic keys. Update to 3.1.3+ immediately!

PoC Released for Notepad++ Flaw Enables Privilege Escalation to NT AUTHORITY\SYSTEM

• Vulnerability

PoC Released for Notepad++ Flaw Enables Privilege Escalation to NT AUTHORITY\SYSTEM

Do Son June 24, 2025 0

CVE-2025-49144 lets attackers gain NT AUTHORITY\SYSTEM via Notepad++ v8.8.1 installer flaw. PoC available—secure paths and signatures urged.

Critical Python Tarfile Flaw (CVE-2025-4517, CVSS 9.4): Arbitrary File Write, PoC Available

• Vulnerability

Critical Python Tarfile Flaw (CVE-2025-4517, CVSS 9.4): Arbitrary File Write, PoC Available

Do Son June 23, 2025 0

A critical flaw (CVE-2025-4517, CVSS 9.4) in Python's tarfile module allows arbitrary file reads/writes outside the extraction directory. PoC is public; update immediately

Critical Pterodactyl RCE (CVSS 10.0): Unauthenticated Attackers Exploiting Flaw Now!

• Vulnerability

Critical Pterodactyl RCE (CVSS 10.0): Unauthenticated Attackers Exploiting Flaw Now!

Do Son June 20, 2025 0

A critical RCE flaw (CVE-2025-49132, CVSS 10.0) in Pterodactyl game server panel allows unauthenticated arbitrary code execution. Malicious actors are already exploiting it.

OpenVPN Driver Flaw: Local Users Can Crash Windows Systems via Buffer Overflow

• Vulnerability

OpenVPN Driver Flaw: Local Users Can Crash Windows Systems via Buffer Overflow

Do Son June 20, 2025 0

A flaw in the OpenVPN Windows kernel driver allows unprivileged local users to crash systems (BSOD) via oversized control packets. Update to 2.6.14-I002.