Do Son Zoom rolls out security updates for 6 newly disclosed flaws in Workplace, Rooms, and SDK, addressing DoS, info disclosure, and XSS across all platforms. Update now!
Denial of Service
Apache Tomcat 9.0.107 patches three critical DoS flaws (CVE-2025-52434, CVE-2025-52520, CVE-2025-53506) that can disrupt web services via HTTP/2, file uploads, and excessive streams.
MongoDB has patched two flaws: CVE-2025-6713 (CVSS 7.7) allows privilege escalation via $mergeCursors, and CVE-2025-6714 (CVSS 7.5) causes mongos DoS.
Redis discloses CVE-2025-48367 (CVSSv4 7.0), a DoS flaw where authenticated clients can misuse multi-bulk commands. No direct code fix is planned; reinforce access controls.
A critical flaw (CVE-2025-49826, CVSS 7.5) in Next.js causes cache poisoning, leading to DoS by serving cached HTTP 204 responses for static pages.
PHP patches two flaws: CVE-2025-1735 allows SQL injection/crashes in pgsql, and CVE-2025-6491 enables DoS in SOAP via oversized XML. Update immediately!
A NFSundown flaw (CVE-2025-38089) in the Linux kernel allows remote attackers to crash NFS servers via a NULL pointer dereference. PoC exploit is public!
A flaw (CVE-2025-6297, CVSS 8.2) in dpkg-deb allows DoS via disk quota exhaustion by leaving temporary files. Update immediately to prevent system instability.
A critical flaw (CVE-2025-6543, CVSS 9.2) in NetScaler ADC/Gateway is actively exploited for DoS. Over 2,100 unpatched appliances remain susceptible. Update immediately!
MongoDB discloses CVE-2025-6710 (CVSS 7.5), a pre-authentication DoS flaw. Crafted JSON inputs can crash servers via stack overflow.
Citrix warns of a critical memory overflow flaw (CVE-2025-6543, CVSS 9.2) in NetScaler ADC/Gateway, actively exploited for DoS. Update to patched versions immediately!
Hitachi Energy warns of 5 flaws in MicroSCADA X SYS600 (v10.0-10.6), including remote DoS, data leaks, and TLS MITM, risking power system control.
IBM warns of three critical QRadar SIEM flaws (CVSS 9.1 RCE, XXE, info disclosure). Update to 7.5.0 UP12 IF02 immediately to protect your SIEM.
A flaw in the OpenVPN Windows kernel driver allows unprivileged local users to crash systems (BSOD) via oversized control packets. Update to 2.6.14-I002.
Cisco ClamAV versions 1.4.3 and 1.0.9 fix critical flaws: CVE-2025-20260 (CVSS 9.8) in PDF scanning could allow RCE, and CVE-2025-20234 (UDF) leads to DoS.
Cisco warns of a critical flaw (CVE-2025-20271, CVSS 8.6) in Meraki MX/Z Series devices, allowing unauthenticated remote DoS on AnyConnect VPN. Update firmware now!
Two critical flaws in Apache Traffic Server (CVE-2025-31698, CVE-2025-49763) allow IP-based ACL bypass and remote DoS via ESI plugin.
A high-severity flaw (CVE-2025-4565) in Google's pure-Python Protobuf backend allows unauthenticated attackers to crash applications via crafted nested messages.
SUSE disclosed flaws in sslh (CVE-2025-46807, CVE-2025-46806) allowing remote DoS attacks via file descriptor exhaustion and unsafe memory access.
Apache Tomcat patched four vulnerabilities affecting versions 9.0, 10.1, and 11.0, ranging from DoS to privilege bypass. Update immediately
Four flaws in libxml2 (CVE-2025-6021, CVE-2025-49794, CVE-2025-49795, CVE-2025-49796) expose systems to memory corruption, RCE, and DoS attacks.
Moxa warns of a high-severity DoS flaw (CVE-2024-9404) in PT-G7728/7828 industrial switches, allowing remote crashes. Update firmware or disable affected services.