Do Son A critical XSS flaw in the Lectora e-learning platform (CVE-2025-9125) allows for malicious code injection, posing a risk of session hijacking and redirection.
CERT/CC
CERT/CC warns of critical flaws in Sunshine for Windows, including unquoted service path and DLL hijacking, that allow local attackers to escalate privileges.
CERT/CC warns of critical flaws in the Hiawatha web server. The vulnerabilities could allow attackers to bypass authentication and hijack sessions.
Critical design flaws in Workhorse Software's municipal accounting platform could allow unauthenticated users to download full database backups with sensitive PII and financial records.
A new vulnerability in AMI Aptio UEFI firmware allows for arbitrary code execution in System Management Mode, a privileged environment that can bypass OS controls.
A new vulnerability, "MadeYouReset," has been discovered in HTTP/2, allowing attackers to exploit stream resets to launch devastating denial-of-service attacks.
CERT/CC reveals critical flaws in Partner Software and Partner Web, including default admin credentials and XSS, that allow unauthenticated RCE on municipal and state systems.
A critical privilege escalation flaw (CVE-2025-6241) in Lakeside Software's SysTrack allows low-privileged local users to gain SYSTEM access via DLL hijacking. Patch immediately.
A TPM 2.0 flaw (CVE-2025-2884) allows local attackers to access sensitive memory or cause DoS. Update TPM firmware to protect trusted computing.
A Insyde H2O UEFI flaw (CVE-2025-4275) allows Secure Boot bypass via NVRAM, enabling attackers to inject undetectable malware and rootkits. Update firmware now!
CERT/CC warns of CVE-2025-3927 in Digigram PYKO-OUT AoIP device, where default no-password access allows attackers to control devices and pivot networks.
CERT/CC reveals systemic jailbreak flaws in major AI models, including ChatGPT and Claude, enabling bypass of safety filters with identical prompt techniques.