Do Son Microsoft patched 193 vulnerabilities this month, including six zero-days (four exploited) and issued the final update for Windows 10 (KB5066791).
rce
SAP's October 2025 Security Patch Day addressed 13 new notes, including two critical 10.0 flaws in NetWeaver AS Java and Print Service, posing an RCE threat.
Microsoft updated Edge’s IE Mode policy after a Chakra zero-day was exploited via phishing. Users must now manually enable and whitelist domains to prevent remote device compromise.
A Critical (CVSS 9.1) flaw (CVE-2025-37729) in Elastic Cloud Enterprise allows authenticated Admin RCE. Attackers exploit Jinjava template injection to exfiltrate data and execute commands.
A Critical RCE flaw (CVE-2025-61929) in Cherry Studio allows attackers to execute arbitrary commands by exploiting a one-click weakness in its custom URL protocol handler.
Apple overhauled its Security Bounty program, offering a $2M base reward (up to $5M with bonuses) for zero-click exploits that match mercenary spyware attacks and bypass Lockdown Mode.
A Critical (CVSS 9.4) flaw in Happy DOM allows untrusted JavaScript to escape the Node.js VM context and achieve RCE on the host system via the Function inheritance chain.
The Zero Day Initiative (ZDI) has published details of two critical vulnerabilities in the popular open-source compression...
Google/Mandiant linked CL0P extortion to a Zero-Day RCE flaw (CVE-2025-61882) in Oracle E-Business Suite. Attackers exploited the bug since July to steal corporate data and deploy GOLDVEIN Java shells.
A Zero-Day LFI flaw (CVE-2025-11371) in Gladinet/Triofox is being actively exploited. Attackers retrieve the Web.config machine key to chain into an unauthenticated RCE exploit.
NVIDIA released an urgent update for its GPU Display Driver, fixing multiple high-severity flaws including RCE via an uncontrolled DLL loading path (CVE-2025-23309). Update now.
A flaw (CVE-2023-28760) in TP-Link AX1800 routers allows unauthenticated attackers on the LAN to gain root RCE by manipulating the MiniDLNA service via a USB drive.
Flowise patched a Critical (CVSS 10.0) RCE flaw (CVE-2025-61913) in WriteFileTool. Authenticated attackers can write arbitrary files to the filesystem to gain command execution.
Deno patched a High-severity flaw (CVE-2025-61787) allowing Command Injection on Windows when spawning batch files. Attackers can execute arbitrary commands via malicious arguments.
OpenSSH (before 10.1) has a flaw (CVE-2025-61984) that allows RCE when ProxyCommand is used. Attackers exploit control characters in usernames to inject commands.
The Qt Group patched two critical flaws in Qt SVG: a UAF bug (CVE-2025-10729) that risks RCE, and recursive pattern element (CVE-2025-10728) leading to stack overflow DoS.
CrowdStrike warns that the Critical RCE zero-day (CVE-2025-61882) in Oracle E-Business Suite is being actively exploited by GRACEFUL SPIDER (Clop affiliate) for corporate data theft. Patch immediately.
A Critical (CVSS 10.0) zero-day RCE flaw (CVE-2025-10035) in GoAnywhere MFT is being actively exploited by the Medusa ransomware group, Storm-1175. Patch immediately.
IBM patched a Critical (CVSS 9.3) LPE flaw (CVE-2025-36356) in Verify Access/Identity Access that allows locally authenticated users to escalate privileges to root. Update to v10.0.9.0-IF3 now.
Rapid7 exposed the unauthenticated RCE chain in Cisco ASA/FTD. CVE-2025-20362 bypasses auth to reach CVE-2025-20333, a buffer overflow in the WebVPN Lua script. Patch immediately.
Synacktiv exposed a critical flaw chain in Snipe-IT. A low-privileged user can exploit a Stored XSS (CVE-2025-59712) to hijack admin sessions and trigger RCE (CVE-2025-59713) via unsafe deserialization.
A flaw in the Unity Runtime (CVE-2025-59489) allows local code execution in games via DLL injection through the Android intent handler. Developers must rebuild their apps.