Do Son A critical flaw (CVE-2024-45208, CVSS 9.8) in Versa Director allows unauthenticated RCE via exposed HA ports. PoC code is public, demanding immediate hardening.
Vulnerability
A critical flaw (CVE-2025-4404, CVSS 9.1) in FreeIPA allows authenticated users to escalate privileges to domain admin via Kerberos impersonation.
A critical flaw (CVE-2025-24288, CVSS 9.8) in Versa Director exposes hardcoded default credentials for high-privilege accounts with sudo access. PoC released. Update now
Two critical flaws in Apache Traffic Server (CVE-2025-31698, CVE-2025-49763) allow IP-based ACL bypass and remote DoS via ESI plugin.
A high-severity flaw (CVE-2025-6020) in Linux PAM's pam_namespace allows unprivileged users to gain root via symlink attacks and race conditions.
A high-severity flaw (CVE-2025-4565) in Google's pure-Python Protobuf backend allows unauthenticated attackers to crash applications via crafted nested messages.
Two critical buffer overflow flaws in D-Link router allow remote code execution. PoC available, no patch will be issued.
Two high-severity Ubiquiti flaws allow privilege escalation via XSS in UCRM and authenticated SQL injection in UISP. Update immediately!
Teleport disclosed a critical remote authentication bypass flaw (CVE-2025-49825) affecting self-hosted instances. Upgrade Proxies and agents immediately!
BeyondTrust warns of a high-severity unauthenticated RCE flaw in Remote Support and PRA, exploitable via the built-in chat feature. Patch immediately
Unauthenticated RCE flaw in Mitel SIP phones (CVSS 9.8) lets attackers gain root via ringtone upload. Exploit PoC shows full system compromise.
Four flaws in libxml2 (CVE-2025-6021, CVE-2025-49794, CVE-2025-49795, CVE-2025-49796) expose systems to memory corruption, RCE, and DoS attacks.
Ricoh warns of critical flaws in Streamline NX V3, including a CVSS 9.8 path traversal (CVE-2025-46783) allowing remote SYSTEM-level code execution.
Mitel warns of a critical path traversal flaw (CVSS 9.8) in MiCollab, allowing unauthenticated attackers to access provisioning data and perform admin actions.
Bosch warns of a critical RCE flaw (CVSS 10.0, CVE-2025-29902) in Telex RDC Server and RTS VLink, allowing unauthenticated remote code execution. Patch immediately!
A critical CI/CD flaw in remote caches allows undetectable code injection and privilege escalation via cache poisoning, bypassing all security controls.
Trend Micro Apex Central has two critical pre-authentication RCE flaws (CVSS 9.8, CVE-2025-49219, CVE-2025-49220). Patch immediately to prevent remote takeover.
A flaw (CVE-2025-4232) in GlobalProtect for macOS allows local users to escalate to root. Public PoC code exists. Update now!
Zero-day CVE-2025-33073 allows remote privilege escalation to SYSTEM on Windows via SMB. PoC available. Fixed in June 10, 2025 Patch Tuesday.
A critical flaw in OpenPGP.js (CVE-2025-47934) allows attackers to spoof valid signatures by appending malicious data to signed messages. PoC code available.
Apache CloudStack LTS updates patch five security flaws, including two critical vulnerabilities in Kubernetes and admin access, risking full system compromise.
A critical Konsole vulnerability allows arbitrary code execution via a telnet:// URL scheme. Linux users must update to 25.04.2 immediately.