Do Son Two Windows Kernel vulnerabilities allow SYSTEM-level privilege escalation. PoC exploit code is publicly available.
Vulnerability
Avaya CMS hit by CVSS 9.9 flaw allowing remote command execution via web request. Affected versions must upgrade to avoid system compromise.
A critical XXE vulnerability (CVSS 9.9) in GeoTools llows data disclosure and RCE. Update immediately to patched versions!
Apache Kafka fixes CVEs exposing clients to RCE, SSRF, and file read attacks. Update to secure versions and review JAAS settings immediately.
A critical RCE flaw (CVE-2025-3835) in ManageEngine Exchange Reporter Plus allows unauthenticated attackers to execute arbitrary commands. Update now!
Critical flaws in Microsoft's Brokering File System (BFS), including race conditions and UAF bugs, expose Windows to privilege escalation. PoC code available. Patch now!
Explore a critical vBulletin RCE vulnerability stemming from a flawed patch. This article details the PHP Object Injection leading to RCE, complete with a PoC
Urgent Acronis Cyber Protect advisory: Critical flaws (CVSS 10.0) expose data. Patch immediately to prevent unauthorized access and data manipulation.
A critical (CVSS 9.8) SQL injection flaw found in popular LlamaIndex (v0.12.21) allows data manipulation, affecting LLM-powered applications.
Critical and high-severity flaws in Python's tarfile module allow arbitrary filesystem writes and bypasses. Update to the latest patched version immediately.
Unauthenticated attackers can fully compromise Dell PowerScale OneFS. Patch now to stop critical NFS access flaws.
Two unpatched CVSS 9.8 flaws in telecom gear enable remote code execution via buffer overflows, exposing critical infrastructure to attack.
PoC reveals how a Linux vsock driver flaw enables local users to escalate privileges to root via a dangerous Use-After-Free vulnerability.
Samba vulnerability (CVE-2025-0620) exposes stale group data in Kerberos SMB sessions. Learn how this impacts security and mitigation.
A critical CVSS 10.0 vulnerability (CVE-2025-5086) in DELMIA Apriso threatens global manufacturing. Urgent action needed to protect production.
High-severity flaws (CVE-2025-20298 & CVE-2025-20297) impact Splunk Enterprise & Universal Forwarder. Learn how to protect your data.
HPE StoreOnce Software has critical vulnerabilities, including a 9.8 CVSS authentication bypass and RCE flaws. Update now to version 4.3.11 or later.
A new DoS vulnerability (CVE-2025-48866) found in ModSecurity WAF can crash your web application. Update to 2.9.10 immediately!
Qualcomm discloses critical zero-day vulnerabilities in Snapdragon chipsets, actively exploited in targeted attacks. Immediate patching is crucial for millions of devices.
Axis Communications releases critical patches for AXIS OS vulnerabilities, including privilege escalation flaws. Update your devices to stay protected.
Apple patches a CoreAudio flaw exploited in the wild via malicious media files, enabling remote code execution. PoC now on GitHub.
Esri patches a critical SSRF vulnerability in Portal for ArcGIS, allowing unauthenticated remote attackers to bypass protections and access internal services.