Do Son "SessionReaper" (CVE-2025-54236) targets Magento stores. Attackers use zombie tokens to gain root access. 200+ sites compromised. Patch now.
root access
TP-Link patches CVE-2025-14756 (CVSS 8.5) in Archer MR600 routers. This command injection flaw allows full device takeover. Update firmware now.
Cisco warns CVE-2026-20045 is being exploited. This critical RCE allows unauthenticated root access on Unified CM. Patch immediately to secure your network.
Akamai reveals critical Vivotek camera flaw CVE-2026-22755. Unauthenticated command injection allows root access. Update legacy firmware now.
PoC exploit code released for critical FortiSIEM flaw CVE-2025-64155 (CVSS 9.4). Unauthenticated RCE allows root access. Upgrade to v7.4.1 now.
HPE warns: Details of Aruba VIA root flaw (CVE-2025-37186) are public. Linux users exposed to LPE. No patch yet—apply the workaround now.
Critical flaw CVE-2025-60262 hits H3C wireless devices. A misconfigured FTP setting grants anonymous users root access. Check your firmware now.
Critical flaw in EOL TOTOLINK EX200 opens unauthenticated root Telnet on error. CVE-2025-65606 exposes your network to total compromise. Replace it now.
JD Cloud alerts users to CVE-2025-66848, a 9.8 critical flaw allowing remote attackers to bypass auth and gain root access on NAS routers.
Cisco warns of a CVSS 10 zero-day (CVE-2025-20393) exploited by Chinese APT UAT-9686 to backdoor Secure Email Gateways with the Aqua malware suite.
SonicWall warns of zero-day attacks chaining CVE-2025-40602 and CVE-2025-23006 to gain unauthenticated root access on SMA1000 appliances. Patch now!
A macOS LPE flaw resurfaces after 7 years, allowing unprivileged users to hijack third-party installers and gain root access. The exploit leverages the hidden .localized directory to confuse the installation path.
A critical LPE flaw (CVSS 9.1) in Plesk's Password-Protected Directories allows Apache configuration injection. Any Plesk user can execute root commands and achieve full server takeover. Update immediately.
A critical unpatched flaw in the TOTOLINK AX1800 router allows unauthenticated HTTP requests to enable Telnet for root RCE. Admins must block WAN access immediately as there is no official fix.
CERT/CC warned that Tenda 4G03 Pro/N300 routers are exposed to an unpatched RCE flaw (CVE-2025-13207). Authenticated attackers can execute root-level commands via web requests due to insecure input handling.
Google has confirmed that the Gemini Nano on-device AI model is blocked from running on Android devices with an unlocked bootloader, citing a feature not found error.
AWS patched a Critical (CVSS 9.3) local flaw (CVE-2025-11462) in its Client VPN for macOS. A non-admin user can gain root privileges via a symlink manipulation attack.
A zero-day flaw in VMware Tools (CVE-2025-41244) allows local attackers to gain root privileges. NVISO confirmed exploitation by a Chinese APT. A public PoC is now available.
A critical vulnerability (CVE-2025-46811, CVSS 9.8) in SUSE Manager allows unauthenticated remote command execution with root privileges on all managed Linux clients.
Kubernetes warns of CVE-2025-7342 (CVSS 8.1) in Image Builder. Default credentials in Windows VM images (Nutanix/OVA) allow unauthenticated root access to clusters. Patch immediately!
A critical flaw (CVE-2025-7503, CVSS 10.0) in Shenzhen Liandian IP cameras allows root access via an undocumented, default-enabled Telnet service with hardcoded credentials. No patch available.
A critical Linux flaw (CVE-2025-6019) in udisksd/libblockdev allows local privilege escalation to root. PoC available. Update now to secure your system!