Do Son Urgent: Modular DS flaw CVE-2026-23550 (CVSS 10) is actively exploited in the wild. Attackers are creating fake admins. Update to the latest version now.
privilege escalation
NVIDIA patches high-severity command injection in Nsight Graphics for Linux (CVE-2025-33206). Update to v2025.5 to prevent code execution.
PoC exploit code released for critical FortiSIEM flaw CVE-2025-64155 (CVSS 9.4). Unauthenticated RCE allows root access. Upgrade to v7.4.1 now.
Critical ServiceNow AI flaw (CVE-2025-12420) allows unauthenticated user impersonation. Self-hosted users: update Now Assist & Virtual Agent immediately.
Critical flaws in InputPlumber (CVE-2025-66005) expose Linux gamers to session hijacking. Update to v0.69.0 or SteamOS 3.7.20 immediately to secure.
Critical Foomuuri flaws (CVE-2025-67603) allow local users to hijack firewall settings. SUSE urges immediate update to v0.31 to secure your system.
CVE-2025-67859: TLP 1.9.0 flaw lets users bypass root auth. SUSE researchers urge Linux users to update to version 1.9.1 to fix this critical security gap.
Critical flaw CVE-2025-60262 hits H3C wireless devices. A misconfigured FTP setting grants anonymous users root access. Check your firmware now.
Veeam updates Backup & Replication v13 to fix high-severity flaws. CVE-2025-59470 and others allow RCE and root access. Update to build 13.0.1.1071.
The Chronomaly exploit weaponizes CVE-2025-38352, a Linux kernel race condition. It allows any local user to gain root access across Android and Linux.
Apache StreamPipes patches CVE-2025-47411, a logic flaw allowing users to manipulate JWT tokens and hijack admin accounts. Update to v0.98.0 now!
TeamViewer patches high-severity flaws in its DEX line, including CVE-2025-44016, which allows attackers to bypass file integrity and execute code.
NVIDIA patches critical 9.8 severity flaws in Isaac Launchable (CVE-2025-33222) that allow RCE via hard-coded credentials. Upgrade to v1.1 now!
SonicWall warns of zero-day attacks chaining CVE-2025-40602 and CVE-2025-23006 to gain unauthenticated root access on SMA1000 appliances. Patch now!
NVIDIA issued a Critical (CVSS 9.0) patch for Isaac Lab and the NeMo Framework, fixing flaws that allow code execution and data tampering in AI models.
A critical LPE (CVE-2025-14282) in Dropbear SSH allows users to gain root access via Unix socket forwarding. Impacting embedded Linux, it's fixed in v2025.89.
A LPE flaw in Windows Admin Center allows any user to gain SYSTEM privileges. It exploits insecure directory permissions and a TOCTOU flaw to execute a DLL hijacking attack.
A critical flaw (CVSS 9.1) in Red Hat OpenShift GitOps lets namespace admins gain root access to the cluster by manipulating ArgoCD CRs. This effectively breaks multi-tenancy. Patch immediately.
0patch found an unpatched flaw in Windows RasMan that allows any user to crash the service on demand. This unprivileged crash is the necessary step to exploit the CVE-2025-59230 LPE flaw. Micropatch is available.
Zoom Rooms patched two flaws: a High-severity (CVSS 7.8) LPE flaw in Windows via downgrade bypass and information disclosure in macOS. Update to v6.6.0 immediately to prevent unauthenticated access.
CISA added two actively exploited zero-days to the KEV: a WinRAR directory traversal (CVE-2025-6218) planting malware in Startup folder, and a Windows Cloud Files UAF for SYSTEM privileges.
A High-severity flaw in macOS PackageKit bypasses a previous fix. Exploiting the user's .zprofile file allows a local attacker to easily gain root privileges.