Do Son A high-severity flaw in the Linux ethtool netlink interface (CVE-2025-21701) enables a Use-After-Free attack to gain root privileges. A PoC has been publicly released.
privilege escalation
A critical flaw (CVE-2025-10725) in Red Hat OpenShift AI allows low-privileged users to escalate to full cluster admin privileges, risking complete platform compromise.
NVIDIA patched multiple flaws, including a critical DLS bug (CVSS 8.7) allowing unauthenticated access and DoS, and a privilege escalation flaw (CVSS 7.8) in the NVIDIA App.
A critical flaw (CVE-2025-7493) in FreeIPA allows authenticated users to exploit Kerberos alias checks to gain full domain administrator privileges. Patch to v4.12.5 now.
A zero-day flaw in VMware Tools (CVE-2025-41244) allows local attackers to gain root privileges. NVISO confirmed exploitation by a Chinese APT. A public PoC is now available.
Broadcom has patched three flaws in VMware Aria Operations and VMware Tools. The vulnerabilities include privilege escalation and information disclosure.
A public PoC has been released for CVE-2025-24085, a zero-day flaw in Apple's Core Media framework that allows a malicious app to elevate its privileges. Update now.
A new report reveals that an exposed Oracle Database was the entry point for a ransomware attack. Hackers used a scheduler function to gain access and deploy malware.
A new Rowhammer attack, "Phoenix," bypasses DDR5 protections on all tested SK Hynix devices, enabling memory corruption and privilege escalation.
A local privilege escalation flaw in PyInstaller (CVE-2025-59042) could let attackers execute code. Check if your apps are at risk.
CERT/CC warns of critical flaws in Sunshine for Windows, including unquoted service path and DLL hijacking, that allow local attackers to escalate privileges.
NVIDIA has released an update for its NVDebug tool, patching three high-severity vulnerabilities that could lead to code execution and privilege escalation.
A new phishing campaign is spreading MostereRAT, a sophisticated RAT that uses a Chinese scripting language and advanced evasion to bypass antivirus and EDR solutions.
A critical macOS flaw (CVE-2025-24204) in gcore allows a user to read any process memory and bypass TCC. A PoC is public, and patching is urgent.
The GNU Guix team has issued an urgent advisory for a privilege escalation flaw in guix-daemon. Local users could gain control of build outputs, risking system integrity.
Ubuntu is replacing the classic sudo with sudo-rs, a memory-safe reimplementation in Rust. The change aims to enhance security and prevent vulnerabilities.
MediaTek's September security bulletin warns of high-severity flaws in its modem that can be exploited by rogue cellular base stations for remote privilege escalation or DoS.
A new vulnerability (CVE-2025-8067) in the Linux UDisks daemon allows unprivileged users to escalate privileges or cause a denial of service. Admins are urged to patch.
A new Active Directory flaw, BadSuccessor, allows low-privileged users to become Domain Admins. Akamai researchers warn that the technique remains a threat even after patching.
Hikvision has issued an advisory for three flaws in its HikCentral products. The most severe, with a CVSS of 8.6, allows an unauthenticated user to get admin access.
Dell has released a critical security advisory for ThinOS 10, with a CVSS 9.6 flaw that allows unauthenticated remote attackers to bypass protection mechanisms.
The Langflow project has issued an important security advisory regarding a newly discovered vulnerability that poses a...