Do Son A High-severity flaw (CVSS 8.0) in Splunk Enterprise/Universal Forwarder for Windows allows low-privileged users to access/tamper with sensitive installation directories due to incorrect permissions. Update to v10.0.2+.
privilege escalation
A 3-flaw chain (CRLF, Auth Bypass, SQLi) achieves root RCE on Synology BeeStation. The exploit uses a "Dirty File Write" SQLi to inject a malicious crontab entry, bypassing the lack of a PHP interpreter.
A Critical (CVSS 9.3) LPE flaw in cPanel's Team Manager API allows a standard user to break out of their directory via path traversal and compromise the shared hosting server. Update immediately.
A Critical (CVSS 9.8) flaw (CVE-2025-8489) in King Addons for Elementor is actively exploited. The bug allows unauthenticated attackers to register as administrators by injecting user_role. 48,400+ attacks blocked.
CVE-2025-60718 lets attackers hijack Windows Administrator Protection to gain full control. Learn how the "Shadow Admin" exploit works.
Kaspersky reveals critical NTLM flaws active in 2025. Attackers use "clickless" exploits like CVE-2024-43451 to steal credentials and gain SYSTEM privileges.
NVIDIA patches 14 flaws in DGX Spark, including a critical SROOT bug (CVSS 9.3) allowing total system takeover. Update to OTA0 immediately.
Grafana Enterprise released emergency patches for CVE-2025-41115 (CVSS 10.0), a critical flaw in SCIM provisioning that could allow attackers to impersonate high-privilege users.
Cisco patched a High-severity EoP flaw (CVE-2025-20341) in Catalyst Center Virtual Appliance. A low-privileged Observer user can remotely elevate privileges to Administrator via a crafted HTTP request.
NVIDIA patched two High-severity flaws in its NeMo Framework. CVE-2025-23361 and CVE-2025-33178 allow local code injection and privilege escalation in AI training environments. Update to v2.5.0.
A High-severity LPE flaw (CVE-2025-60710) in the WindowsAI Recall Policy Configuration scheduled task allows local users to gain SYSTEM privileges via a symlink arbitrary delete attack.
Dell patched a Critical (CVSS 9.1) flaw (CVE-2025-46608) in Dell Data Lakehouse that allows a high-privileged remote attacker to escalate privileges and gain unauthorized administrative control. Update to v1.6.0.0.
A Critical flaw (CVE-2025-11919) in Wolfram Cloud allows RCE and privilege escalation. Attackers exploit a race condition in the shared /tmp/ directory to inject code into other tenants' JVMs.
Microsoft's November Patch Tuesday fixes 68 vulnerabilities, including CVE-2025-62215, an actively exploited Windows Kernel zero-day allowing local attackers to gain SYSTEM privileges via a race condition.
Devolutions patched two flaws in Devolutions Server: A Critical (CVSS 9.4) Auth Bypass allows user impersonation via pre-MFA cookie replay, and another flaw leaks plaintext passwords to view-only users.
Elastic patched a High-severity flaw (CVE-2025-37735) in Elastic Defend for Windows. A local attacker can delete arbitrary files via the SYSTEM service, risking privilege escalation. Update to v8.19.6+.
A High-severity LPE flaw (CVE-2025-55680) in the Windows Cloud Files Driver allows local users to gain SYSTEM privileges by exploiting a TOCTOU race condition. Patch immediately.
OCI patched three critical runc flaws allowing container escape and host DoS/RCE. Attackers exploit mount race conditions in maskedPaths and /dev/console bind-mounts. Update to v1.2.8+.
AWS patched a High-severity flaw (CVE-2025-12779) in the WorkSpaces client for Linux. A local user can extract DCV authentication tokens to hijack another user’s virtual desktop session. Update to v2025.0.
Dell patched seven flaws in CloudLink, including two Critical bugs that allow an authenticated user to escape the restricted shell and execute arbitrary commands for system takeover. Update to v8.2.
NVIDIA patched a High-severity EoP flaw (CVE-2025-23358) in the NVIDIA App installer for Windows. A local attacker could exploit a search path issue to achieve code execution with elevated privileges.
A Critical (CVSS 9.8) Auth Bypass in AI Engine is actively exploited. The flaw exposes the MCP bearer token via the REST API when No-Auth URL is enabled, allowing admin takeover.