Do Son Hikvision has issued an advisory for three flaws in its HikCentral products. The most severe, with a CVSS of 8.6, allows an unauthenticated user to get admin access.
CVSS
Two unpatched CVSS 9.8 flaws in telecom gear enable remote code execution via buffer overflows, exposing critical infrastructure to attack.
Critical CVSS 9.6 vulnerability in IBM QRadar & Cloud Pak for Security exposes systems to RCE & DoS. Patch immediately to secure your platforms.
HPE StoreOnce Software has critical vulnerabilities, including a 9.8 CVSS authentication bypass and RCE flaws. Update now to version 4.3.11 or later.
Netwrix warns of critical 10.0 CVSS flaws in Directory Manager v11, including a hard-coded password. Patch immediately to prevent unauthorized access and data breaches.
A critical IBM Tivoli Monitoring flaw (CVSS 9.8) allows remote arbitrary code execution due to improper array validation. Update now.
A critical Icinga 2 vulnerability (CVSS 9.3) allows malicious certificate impersonation, affecting builds with older OpenSSL. Update now!
A critical Mitsubishi MELSEC iQ-F Series CPU module flaw allows remote DoS and info leak. No software patch available.
Java applications face a critical risk! A flaw in Apache Commons BeanUtils (CVSS 8.8) can lead to arbitrary code execution. Update immediately.
A critical Cyrus IMAP vulnerability (CVSS 9.8) on openSUSE allows unprivileged users to gain root access, risking full system compromise.
Amazon Redshift Python Connector has a high severity vulnerability allowing OAuth2 token interception due to missing SSL validation.
Critical flaws (CVSS 9.8) in Weidmueller industrial switches allow unauthenticated remote attackers full system compromise. Update firmware.
Lenze VPN Client for x500 IoT gateways has critical flaws allowing arbitrary code execution via local privilege escalation.
Critical (CVSS 10) unpatched flaw in TI WooCommerce Wishlist allows unauthenticated RCE via file upload. Affects 100K+ sites.
A critical Canon printer vulnerability (CVE-2025-2146, CVSS 9.8) allows network attackers to execute arbitrary code. Update firmware now.
Critical vulnerabilities (CVSS 9.8) in the Langroid Python framework allow remote code execution in LLM applications. Update to version 0.53.15 now!
Critical vulnerability (CVSS 9.8) in Rockwell Automation! Learn about the high-risk flaw and how to protect industrial systems.