Do Son CISA warns of a Critical RCE flaw (CVSS 9.8) in Megasys Telenium Online Web Application. The vulnerability allows unauthenticated attackers to execute arbitrary OS commands.
CISA
CISA has added a high-severity V8 zero-day (CVE-2025-10585) to its exploited vulnerabilities catalog. An urgent Chrome update is available to patch the flaw.
CISA warns of critical vulnerabilities in ProGauge MagLink fuel monitors, leaving fuel stations and industrial sites at risk of denial-of-service and unauthorized access.
CISA has released a new report detailing how attackers are exploiting Ivanti EPMM flaws to deploy malicious listeners and gain remote code execution.
CISA issued a security advisory for Delta Electronics DIALink vulnerabilities, including a critical 10.0 CVSS flaw that could allow authentication bypass.
CISA has issued an advisory for a critical flaw in Daikin Security Gateway devices that could allow attackers to bypass authentication and gain full access.
CISA adds a critical deserialization flaw in Dassault Systèmes DELMIA Apriso (CVE-2025-5086) to its KEV catalog, with active exploitation confirmed.
CISA adds three new vulnerabilities to its KEV Catalog, including flaws in the Linux kernel, Android Runtime, and Sitecore CMS. All are being actively exploited.
CISA has added two TP-Link router flaws to its KEV Catalog, including an RCE vulnerability in end-of-life devices. Both are being actively exploited in the wild.
CISA warns of a critical flaw (CVE-2025-9696) in SunPower PVS6 solar inverters. Hardcoded Bluetooth encryption parameters allow attackers to gain full control.
CISA adds two flaws to its KEV Catalog: a TP-Link factory reset flaw and a WhatsApp zero-click vulnerability used in targeted spyware attacks. Patching is urgent.
The NSA, CISA, and partners have released a joint advisory exposing how Chinese APT groups are compromising telecom and government networks for global espionage.
A zero-day authentication bypass flaw (CVE-2025-54309) in CrushFTP is being actively exploited in the wild. A PoC is available, and an urgent patch is required.
CISA has added two Citrix and one critical Git vulnerability to its KEV Catalog, warning that all three flaws are being actively exploited by malicious actors.
A critical RCE flaw in Trend Micro Apex One has been added to CISA's KEV Catalog due to active exploitation. All agencies must patch by September 8.
CISA warns of a critical authentication bypass flaw (CVE-2025-8284, CVSS 9.8) in Packet Power devices, allowing unauthenticated remote attackers to gain full access.
CISA warns of a critical authentication bypass flaw (CVE-2025-5095, CVSS 9.8) in ARC Solo devices, allowing attackers to change passwords and take full remote control without authentication.
CISA warns of critical flaws in EG4 Electronics inverters (CVSS up to 9.2), allowing attackers to install malicious firmware, hijack control, and disrupt power generation.
CISA issues an urgent warning about "ToolShell," a sophisticated exploit chain targeting SharePoint servers with multiple vulnerabilities to install webshells and steal crypto keys.
CISA warns of critical flaws in Tigo Energy's Cloud Connect Advanced devices, including hard-coded credentials and command injection, that could allow remote attackers to take full control of solar systems.
CISA issues an urgent advisory on CVE-2025-8286, a critical vulnerability in Güralp FMUS seismic devices exposing an unauthenticated Telnet interface that allows remote attackers to reconfigure, tamper with, or factory reset devices.
A joint advisory from US, UK, Canada, and Australia warns of Scattered Spider's evolving tactics, now using DragonForce ransomware, spearphishing, SIM swapping, and MFA fatigue to compromise systems.