Do Son CISA adds a critical deserialization flaw in Dassault Systèmes DELMIA Apriso (CVE-2025-5086) to its KEV catalog, with active exploitation confirmed.
rce
Microsoft's September Patch Tuesday addresses 86 flaws, including two zero-days and nine critical vulnerabilities in Windows, Office, Hyper-V, and Azure.
CERT/CC warns of critical flaws in the Hiawatha web server. The vulnerabilities could allow attackers to bypass authentication and hijack sessions.
Ivanti has released a security update for Endpoint Manager, patching two high-severity RCE flaws (CVSS 8.8) that could allow unauthenticated attackers to execute code.
A critical CSRF flaw in Rockwell Stratix switches (CVE-2025-7350) could allow unauthenticated remote attackers to achieve RCE. The flaw has a CVSS score of 9.6.
Today, SAP released 21 new Security Notes and 4 updates as part of its monthly Security Patch...
Progress Software has patched a high-severity RCE flaw (CVE-2025-7388) in OpenEdge AdminServer. The bug allows authenticated attackers to execute commands via Java RMI.
A critical flaw in the cJSON library (CVE-2025-57052) allows attackers to bypass array bounds checking with a malformed JSON pointer. The bug has a CVSS 9.8 score.
A critical flaw in ABB ASPECT BMS (CVE-2025-53187) allows unauthenticated remote attackers to achieve RCE with a CVSS 9.8 score. Admins must patch or disconnect systems.
A critical deserialization flaw (CVE-2025-5086) in DELMIA Apriso could allow remote code execution. Exploit attempts have been seen in the wild.
A critical RCE flaw (CVSS 10.0) in the DeepDiff Python library allows for arbitrary code execution via class pollution. A PoC is public, and patching is urgent.
A coordinated disclosure by Mandiant and Sitecore has revealed the active exploitation of a critical configuration vulnerability...
CISA has added two TP-Link router flaws to its KEV Catalog, including an RCE vulnerability in end-of-life devices. Both are being actively exploited in the wild.
Google has released Chrome 140, patching six vulnerabilities including a high-severity use-after-free flaw in the V8 JavaScript engine that could allow for remote code execution.
A new report reveals a critical one-click RCE flaw (CVSS 8.8) in the Dive desktop app. A malicious URL could hijack a user's machine. Update to v0.9.4 now.
A critical RCE flaw (CVE-2025-53772) in IIS Web Deploy allows an authenticated attacker to execute arbitrary code. A PoC is public, and patching is urgent.
Google's new Android update patches dozens of flaws, including two actively exploited vulnerabilities and a critical RCE that can be triggered without user interaction.
Qualcomm's latest bulletin patches two critical modem flaws (CVE-2025-21483 & CVE-2025-27034) with CVSS 9.8 scores, enabling remote code execution via rogue cellular base stations.
A critical RCE flaw (CVE-2024-13986) in Nagios XI allows an authenticated attacker to upload and execute a malicious PHP shell, taking control of the server.
A critical zero-click flaw in WhatsApp (CVE-2025-55177), paired with an Apple zero-day, was used in sophisticated attacks. All users must update now.
ImageMagick has a format string bug (CVE-2025-55298) that can lead to RCE. A PoC is public, and an urgent patch is available for versions 7.1.2-2 and 6.9.13-28.
A critical zero-day (CVE-2025-57819) in FreePBX with a CVSS 10.0 score is being actively exploited. The flaw allows unauthenticated RCE, and admins must patch immediately.