Do Son SmarterMail hits a 10/10 CVSS severity! CVE-2025-52691 allows unauthenticated RCE via arbitrary file uploads. Update to Build 9413 immediately!
Enterprise Security
IBM issues a 9.8 critical alert for API Connect! CVE-2025-13915 allows unauthenticated remote access. Update to v10.0.11 or apply iFixes now.
IBM patched four critical flaws in AIX/VIOS. The RCE (CVSS 10.0) in nimesis and CVE-2025-36096 allow remote attackers to execute commands and obtain NIM private keys. Update immediately.
GitLab patched two high-severity flaws: CVE-2025-11340 (Auth Bypass) allows API write access with read-only tokens, and CVE-2025-10004 permits unauthenticated DoS via GraphQL.
A new Morte botnet campaign is exploiting command injection flaws to hijack SOHO routers and enterprise apps. The Loader-as-a-Service model saw a 230% spike this summer.
The Cloud Software Group has released urgent updates for NetScaler ADC and Gateway to patch a zero-day (CVE-2025-7775) being actively exploited in the wild.
CISA has added two Citrix and one critical Git vulnerability to its KEV Catalog, warning that all three flaws are being actively exploited by malicious actors.
A new Rapid7 report reveals four critical flaws in Securden's Privileged Access Manager, including authentication bypass and RCE, that could expose passwords and secrets.
Salesforce has patched several critical vulnerabilities in Tableau Server, including a Type Confusion flaw with a CVSS score of 9.6 that could allow for local code inclusion.
IBM has issued a critical security bulletin for a flaw (CVE-2025-36157) in its Jazz Team Server. The vulnerability could allow unauthenticated remote attackers to take control of affected systems.
IBM warns of a critical RCE flaw (CVE-2025-36038) in WebSphere Application Server 8.5/9.0, allowing unauthenticated attackers to execute arbitrary code via serialization.
A critical flaw (CVE-2024-45208, CVSS 9.8) in Versa Director allows unauthenticated RCE via exposed HA ports. PoC code is public, demanding immediate hardening.
A high-severity flaw (CVE-2025-37100) in HPE Aruba Private 5G Core allows unauthorized access to sensitive system files. Update to 1.25.1.1 immediately!
Ivanti patches three Workspace Control flaws exposing sensitive credentials due to hardcoded keys. Update immediately to secure your enterprise.
A critical RCE flaw (CVE-2025-3835) in ManageEngine Exchange Reporter Plus allows unauthenticated attackers to execute arbitrary commands. Update now!
Critical CVSS 9.8 flaws in HPE Insight Remote Support could allow remote code execution and SYSTEM-level file access. Patch now to stay secure.
Rapid7 found critical RCE flaws in MICI NetFax (versions < 3.0.1.0) via default credentials & command injection. Vendor refuses to patch, advising no internet exposure.
Canon urges users to mitigate high-severity flaws in a range of printers that could allow sensitive data extraction.
Two flaws in Mitel SIP phones—CVE-2025-47188 and CVE-2025-47187—enable remote command execution and file uploads, putting enterprise networks at risk.
Google GTIG reveals rise in zero-day exploits targeting enterprise tools, while browser and mobile vulnerabilities decline in 2024 threat landscape.
Google introduces Unified Security, powered by Gemini AI, to streamline enterprise cybersecurity. Discover new AI security agents, enhanced threat detection, and data protection tools for comprehensive security management.