Do Son Critical React flaw CVE-2025-55182 (CVSS 10.0) under mass exploitation. Two IPs drive 56% of attacks deploying miners & shells. Upgrade to v19.0.1+ now.
DevSecOps
Critical Ingress-Nginx flaws (CVE-2026-1580) allow RCE and secret theft via config injection. Upgrade to v1.13.7 or v1.14.3 immediately to secure K8s.
Critical Kyverno flaw CVE-2026-22039 (CVSS 10) allows policy creators to gain cluster admin rights. Update to v1.16.3 to fix privilege escalation & DoS.
Critical n8n RCE (CVE-2026-1470) lets attackers bypass sandbox defenses via malicious expressions. CVSS 9.9. Check versions 1.123.17 & 2.x now.
Attackers exploit GitHub forks ("Repo Squatting") to push HijackLoader malware via official-looking URLs. Technique remains active; verify all downloads.
Critical Appsmith flaw CVE-2026-24042 (CVSS 9.4) allows public users to execute private, unpublished actions. Update to v1.95 now to secure your apps.
Apache patches bRPC flaw CVE-2025-60021. Vulnerable heap profiler allows remote command injection. Upgrade to v1.15.0 to secure your infrastructure.
Urgent: Node.js patches CVE-2025-55131 (High Severity). "Dirty" memory flaw exposes secrets. Update to v20.20.0/v22.22.0 now to stop data leaks.
CISA warns: Active exploits target Gogs Git service via CVE-2025-8110 (CVSS 8.7). Attackers use symlink bypass for RCE. Patch by Feb 2, 2026.
Alert: Public exploit released for n8n CVE-2026-21858 (CVSS 10.0). Unauthenticated attackers can seize full control. Update to v1.121.0 now.
GitLab patches critical Stored XSS (CVE-2025-9222) and AI flaws in versions 18.7.1, 18.6.3, & 18.5.5. Update immediately to secure your pipelines.
Urgent: n8n CVE-2026-21877 (CVSS 10.0) allows full server compromise via Git node. Update to v1.121.3 now to prevent RCE and arbitrary file writes.
CVE-2025-68668: A critical n8n flaw lets attackers escape the Python sandbox for full RCE. Learn how this bridge failure leads to total system compromise.
A High-severity flaw (CVE-2025-63387) in Dify v1.9.1 allows unauthenticated users to access sensitive system configurations via an unprotected API.
A Headlamp flaw allows unauthenticated users to reuse cached credentials to hijack Kubernetes Helm operations. Update to v0.39.0!
SUSE patched a Critical RCE flaw (CVE-2025-54469, CVSS 10.0) in NeuVector Enforcer that allows attackers to inject commands via unsanitized environment variables, risking container root shell access.
Stay ahead in 2025 with top API security best practices for security teams—covering auth, rate limiting, encryption, and threat detection.