Do Son OpenSSL patches three flaws, including CVE-2025-9230 (RCE/DoS risk) and a SM2 timing side-channel (CVE-2025-9231) that could allow private key recovery on ARM64.
security advisory
A critical SNMP flaw (CVE-2025-20352) in Cisco IOS/IOS XE is being actively exploited, allowing attackers root access. Urgent patching and mitigation required!
SolarWinds alerts on a Salesforce data breach impacting numerous companies. The breach exploited compromised OAuth tokens via the Salesloft Drift integration, exposing sensitive customer data.
Two critical vulnerabilities (CVSS 10 & 9.8) in Digiever NVRs allow unauthenticated attackers to steal credentials and execute commands. Update your firmware immediately.
A critical Angular SSR vulnerability (CVE-2025-59052) could expose user data. Learn about the flaw, affected versions, and how to protect your application.
A new security advisory reveals two high-severity flaws in FreePBX, including a stored XSS and a shared OAuth key that could allow for API token forgery and admin compromise.
The GNU Guix team has issued an urgent advisory for a privilege escalation flaw in guix-daemon. Local users could gain control of build outputs, risking system integrity.
Sangoma has issued an urgent security advisory for a FreePBX exploit. Admins with publicly exposed control panels are urged to lock down access immediately.
The Langflow project has issued an important security advisory regarding a newly discovered vulnerability that poses a...
SonicWall warns of CVE-2025-40599 in SMA 100 series, allowing authenticated admins to upload arbitrary files, potentially leading to RCE.
Microsoft warns of active zero-day exploitation (CVE-2025-53770, CVSS 9.8) in on-premises SharePoint Server. No patch is available, but mitigations are provided.
CrushFTP has issued an urgent advisory for CVE-2025-54309, a critical zero-day allowing remote exploitation via HTTP(S), already being actively used in the wild.
Apache CXF versions are vulnerable to DoS attacks and sensitive data leaks (CVE-2025-48795) due to improper handling of large messages. Update immediately!
Cisco warns of a critical flaw (CVE-2025-20271, CVSS 8.6) in Meraki MX/Z Series devices, allowing unauthenticated remote DoS on AnyConnect VPN. Update firmware now!
A high-severity path traversal flaw (CVE-2025-23092) in Mitel OpenScape Accounting Management allows authenticated admins to upload malicious files for RCE. Update now!
Mitel warns of a critical path traversal flaw (CVSS 9.8) in MiCollab, allowing unauthenticated attackers to access provisioning data and perform admin actions.
Bosch warns of a critical RCE flaw (CVSS 10.0, CVE-2025-29902) in Telex RDC Server and RTS VLink, allowing unauthenticated remote code execution. Patch immediately!
A medium-severity flaw (CVE-2025-41234) in Spring Framework allows Reflected File Download (RFD) attacks. Update to 6.2.8, 6.1.21, or 6.0.29 immediately
Avaya CMS hit by CVSS 9.9 flaw allowing remote command execution via web request. Affected versions must upgrade to avoid system compromise.
A high-severity XSS flaw (CVE-2025-5806) in Jenkins Gatling Plugin bypasses CSP, risking session hijacking and credential theft. Downgrade to v1.3.0 immediately!
Urgent Acronis Cyber Protect advisory: Critical flaws (CVSS 10.0) expose data. Patch immediately to prevent unauthorized access and data manipulation.
Critical CVSS 9.8 flaws in HPE Insight Remote Support could allow remote code execution and SYSTEM-level file access. Patch now to stay secure.