Do Son Siemens warns of critical flaws (CVE-2025-40736 CVSS 9.8 Auth Bypass, SQLi, Path Traversal) in SINEC NMS, allowing unauthenticated remote root access and RCE.
rce
Microsoft's July 2025 Patch Tuesday fixes 140 flaws, including a SQL Server zero-day (CVE-2025-49719), multiple RCEs, critical Office/Word bugs, and AMD CPU-level threats.
Fortinet released a critical patch for FortiWeb (CVE-2025-25257, CVSS 9.6). This unauthenticated SQL injection flaw allows remote code execution; update immediately!
Phoenix Contact warns of critical flaws (CVE-2025-25270 CVSS 9.8 RCE, CVE-2025-25268 Auth Bypass, CVE-2025-25271 OCPP Reconfig, CVE-2025-25269 LPE) in CHARX SEC-3xxx EV controllers.
MediaTek's July 2025 bulletin reveals critical flaws in chipsets, enabling local EoP, remote RCE, and info disclosure in smartphones, AIoT devices, and smart TVs.
SAP's July 2025 Patch Day fixes 27 vulnerabilities, including critical RCE (CVSS 10.0) in Live Auction Cockpit and multiple insecure deserialization flaws (CVSS 9.1) across NetWeaver components.
JPCERT/CC warns of critical flaws in Nimesa Backup and Recovery (CVE-2025-48501, CVSS 9.8 RCE; CVE-2025-53473 SSRF). Unsupported versions pose severe risk to AWS data.
A flaw (CVE-2025-48367, CVSS 7.0) in Redis HyperLogLog allows authenticated RCE via out-of-bounds writes. PoC available. Update to 8.0.3, 7.4.5, 7.2.10, or 6.2.19!
Synacktiv unveils chained flaws in ScriptCase's prod console (CVE-2025-47227/47228) allowing pre-authenticated RCE via password reset & shell injection, risking web servers.
IBM X-Force reveals Azure Arc can be exploited for RCE and privilege escalation via hardcoded secrets, recoverable credentials, and overscoped roles, turning it into a stealthy threat vector.
A flaw (CVE-2025-53367, CVSS 8.4) in DjVuLibre allows remote code execution on Linux via out-of-bounds write. PoC is available; patch to v3.5.29 immediately.
Microsoft Edge version 138.0.3351.65 fixes two RCE flaws: a V8 zero-day (CVE-2025-6554) actively exploited, and an Edge-specific type confusion (CVE-2025-49713).
Palo Alto Networks reveals thousands of exploit attempts targeting RCE flaws in Apache Tomcat (CVE-2025-24813) and Apache Camel (CVE-2025-27636, CVE-2025-29891).
A critical flaw (CVE-2025-34067, CVSS 10.0) in HIKVISION applyCT allows unauthenticated RCE via Fastjson deserialization, risking surveillance systems. Patch immediately!
Cymulate reveals two flaws (CVE-2025-53110, CVE-2025-53109) in Anthropic's Filesystem MCP Server, allowing path traversal, symlink attacks, and RCE, exposing AI developer machines.
Wiz Research Team uncovers rapid exploitation of exposed JDWP interfaces, deploying XMRig cryptominers in TeamCity and other Java environments within hours of exposure.
A critical flaw (CVE-2025-34074, CVSS 9.4) in Lucee allows authenticated admins to achieve RCE by abusing scheduled tasks. A Metasploit module is out; urgent patching needed!
Actively Exploited Google Chrome Zero-Day (CVE-2025-6554) Added to CISA’s KEV Catalog, PoC Available
Actively Exploited Google Chrome Zero-Day (CVE-2025-6554) Added to CISA’s KEV Catalog, PoC Available
Google has urgently patched a high-severity zero-day (CVE-2025-6554) in Chrome's V8 JavaScript engine. This type confusion flaw is actively exploited in the wild, risking RCE.
Grafana warns of four critical RCE flaws in Image Renderer and Synthetic Monitoring Agent, stemming from Chromium V8 bugs. Update to patched versions immediately!
Cisco warns of two critical flaws (CVE-2025-20281, CVE-2025-20282, CVSS 10.0) in ISE and ISE-PIC allowing unauthenticated remote root code execution. Apply patches immediately.
A critical RCE flaw (CVE-2025-47812, CVSS 10.0) in Wing FTP Server allows unauthenticated attackers to execute arbitrary Lua code via NULL byte injection, compromising the server
A critical flaw (CVE-2025-6463, CVSS 8.8) in Forminator WordPress plugin allows unauthenticated arbitrary file deletion, leading to site takeover.