Do Son NVIDIA has released a critical security update for its NeMo Framework, patching four high-severity flaws that could allow attackers to execute code and tamper with AI pipelines.
rce
A zero-day authentication bypass flaw (CVE-2025-54309) in CrushFTP is being actively exploited in the wild. A PoC is available, and an urgent patch is required.
NVIDIA has issued a high-severity security update for a flaw (CVE-2025-23307) in NeMo Curator. The vulnerability allows code injection and could compromise AI training pipelines.
The Langflow project has issued an important security advisory regarding a newly discovered vulnerability that poses a...
Two critical flaws in the open-source BI tool DataEase allow attackers to achieve remote code execution and arbitrary file writes, exposing unpatched systems to compromise.
A new Rapid7 report reveals four critical flaws in Securden's Privileged Access Manager, including authentication bypass and RCE, that could expose passwords and secrets.
A critical vulnerability in the Directus API (CVE-2025-55746) allows unauthenticated attackers to silently upload and modify files, leading to webshells and RCE.
A new report reveals a stealthy attack on GeoServer using a critical RCE flaw. Instead of ransomware, attackers are hijacking servers to earn passive income.
A critical flaw in the AI tool CodeRabbit allowed a researcher to gain RCE and write access to over a million repositories via a malicious pull request.
A critical RCE flaw in Trend Micro Apex One has been added to CISA's KEV Catalog due to active exploitation. All agencies must patch by September 8.
A critical directory traversal vulnerability (CVE-2025-48387) in the popular NPM package tar-fs allows attackers to write arbitrary files and gain RCE.
A new security update for PostgreSQL fixes three vulnerabilities, including two critical flaws that could lead to remote code execution.
Two critical remote code execution (RCE) vulnerabilities with CVSS scores of 9.8 were found in the open-source Flowise AI platform.
A critical vulnerability (CVE-2025-20265) in Cisco Secure Firewall Management Center allows unauthenticated attackers to execute commands with high privilege.
A critical 9.8-rated vulnerability in the popular "Database for Contact Form 7" plugin could let unauthenticated attackers delete files and gain full control of sites.
Microsoft’s August Patch Tuesday fixes 119 flaws, including a publicly disclosed Kerberos zero-day (CVE-2025-53779) that could lead to domain admin privileges.
A critical vulnerability (CVE-2025-32433, CVSS 10.0) in Erlang/OTP’s SSH daemon allows unauthenticated RCE and is actively exploited, with a focus on operational technology (OT) networks.
Google has paid out its highest-ever Chrome bug bounty of $250,000 for a critical sandbox escape flaw that could bypass multiple security layers.
A critical vulnerability (CVE-2025-55188, CVSS 2.7) in 7-Zip allows remote attackers to perform arbitrary file writes via a crafted archive, potentially leading to code execution.
Xerox has patched two critical vulnerabilities (CVE-2025-8355, CVE-2025-8356) in FreeFlow Core 8.0.4, allowing attackers to exploit XML and path traversal flaws to achieve RCE and SSRF.
ESET warns of an actively exploited WinRAR zero-day (CVE-2025-8088). The path traversal flaw allows attackers to execute code by crafting malicious archives.
Ubiquiti has issued an advisory for a critical flaw (CVE-2025-24285, CVSS 9.8) in its UniFi Connect EV Stations, allowing remote command injection and unauthenticated RCE.