Do Son CISA warned of three Critical flaws (CVSS 10.0) in Radiometrics VizAir weather systems. Unauthenticated attackers can manipulate wind shear alerts and runway configurations, risking hazardous flight conditions.
Critical Vulnerability
CISA warned of a Critical Auth Bypass flaw (CVE-2025-12108, CVSS 9.8) in Survision LPR Cameras. The lack of password enforcement allows unauthenticated attackers to gain full system access.
A Critical RCE flaw (CVE-2025-11953, CVSS 9.8) in React Native Community CLI allows unauthenticated attackers to execute arbitrary code via a command injection in the exposed Metro Dev Server.
A Critical (CVSS 9.8) LFI flaw (CVE-2025-12493) in ShopLentor (WooCommerce Builder) allows unauthenticated attackers to run arbitrary .php files and compromise 100K+ e-commerce sites.
A Critical (CVSS 9.8) Auth Bypass in the Jobmonster theme's check_login() function is actively exploited. The flaw allows unauthenticated attackers to gain admin access to job board sites.
A critical security vulnerability has been identified and is being actively exploited in the King Addons for...
Urgent! DNN Platform has a Critical CVSS 10.0 flaw allowing unauthenticated users to overwrite files, leading to site defacement & XSS. Update to 10.1.1.
WSO2 patched three Critical flaws (CVSS 9.8) in API Manager/Identity Server. Flaws in regex access control and case-sensitive HTTP methods allow unauthenticated administrative takeover.
CISA added two critical DELMIA Apriso flaws (CVE-2025-6204/6205) to its KEV Catalog due to active exploitation. The flaws risk RCE and privileged access to manufacturing management systems.
IBM issued an urgent advisory for a Critical (CVSS 9.8) Auth Bypass flaw (CVE-2025-36386) in Maximo Manage. The flaw in MXCSP allows unauthenticated access to Cognos Analytics.
A path traversal flaw (CVE-2025-62725) in Docker Compose lets attackers overwrite host files via remote OCI artifact annotations, triggered by read-only commands.
A Critical (CVSS 10.0) flaw (CVE-2025-61481) in MikroTik RouterOS/SwOS exposes the WebFig management interface over unencrypted HTTP by default, allowing remote credential theft via MitM.
CISA warned of two critical flaws in Veeder-Root TLS4B ATG systems. The RCE (CVE-2025-58428, CVSS 9.9) allows command injection via the SOAP interface, risking system takeover and energy disruption.
Dell patched three flaws in Storage Manager, including a Critical (CVSS 9.8) Auth Bypass (CVE-2025-43995) that allows remote, unauthenticated access to the Data Collector’s APIProxy.war component.
Ubiquiti issued an urgent patch for a Critical Auth Bypass flaw in UniFi Access. Attackers with network access can fully take over door management systems.
CISA warned of 9 flaws in AutomationDirect PLCs. The Critical RCE (CVE-2025-61934, CVSS 10.0) allows unauthenticated file manipulation on a simulator service. Patch to v4.5.0.x immediately.
Wordfence warned of a massive RCE campaign (8.7M+ attacks) exploiting flaws in GutenKit/Hunk Companion plugins. Unauthenticated attackers can install malicious plugins via vulnerable REST API endpoints.
The Internet Systems Consortium (ISC) has issued patches for three high-severity vulnerabilities impacting the BIND 9 DNS...
Atlassian patched a Critical (CVSS 8.7) Path Traversal flaw (CVE-2025-22167) in Jira Software/Service Management that allows attackers to perform arbitrary file writes. Immediate update is urged.
A Critical RCE flaw (CVE-2025-59287, CVSS 9.8) in WSUS allows unauthenticated attackers SYSTEM access via AuthorizationCookie deserialization. The issue was patched in the October update.
CISA issued an alert for a Critical (CVSS 9.8) Auth Bypass flaw (CVE-2025-11534) in Raisecom RAX701-GC routers, allowing unauthenticated root shell via SSH. The vendor has not yet responded with a patch.
Sauter patched six flaws in modulo 6 devices. The Critical CVE-2025-41723 (CVSS 9.8) flaw allows unauthenticated file upload via the SOAP interface, risking RCE. Update to v3.2.0.