Do Son GitLab patched a High-severity Stored XSS flaw (CVE-2025-11224, CVSS 7.7) in the Kubernetes proxy feature. The bug allows authenticated users to hijack administrator sessions. Update to v18.5.2+.
security patch
Elastic patched two Kibana flaws: CVE-2025-59840 XSS via Vega visualizations and CVE-2025-37734 (SSRF) via the Observability AI Assistant. Update to v9.2.1 immediately.
Apache OpenOffice 4.1.16 fixes seven security flaws, including a memory corruption bug and six issues that allow unprompted loading of remote content via documents, risking system info leak and malware delivery.
GitLab patched a critical runner hijacking flaw (CVE-2025-11702) allowing authenticated users to compromise CI/CD pipelines, plus three unauthenticated DoS vulnerabilities.
Esri released a patch for a Critical (CVSS 10.0) SQL Injection flaw in ArcGIS Server v11.3, 11.4, and 11.5 that allows RCE and data access. Update immediately.
Critical Squid SNMP flaw CVE-2025-59362 lets attackers exploit a stack-based buffer overflow to execute arbitrary code or crash systems.
Apache HTTP Server 2.4.64 patches 8 vulnerabilities, including HTTP Response Splitting, SSRF, DoS, and TLS desync attacks. Upgrade immediately!
SAP's July 2025 Patch Day fixes 27 vulnerabilities, including critical RCE (CVSS 10.0) in Live Auction Cockpit and multiple insecure deserialization flaws (CVSS 9.1) across NetWeaver components.
A critical flaw (CVE-2025-6543, CVSS 9.2) in NetScaler ADC/Gateway is actively exploited for DoS. Over 2,100 unpatched appliances remain susceptible. Update immediately!
Citrix warns of a critical memory overflow flaw (CVE-2025-6543, CVSS 9.2) in NetScaler ADC/Gateway, actively exploited for DoS. Update to patched versions immediately!
TeamViewer disclosed a high-severity flaw (CVE-2025-36537, CVSS 7.0) in its Remote Management for Windows, allowing local unprivileged users to delete files with SYSTEM privileges
Two severe Gogs flaws: CVE-2024-56731 (CVSS 10.0) allows RCE via symlink exploit, and CVE-2025-47943 (CVSS 6.3) is a stored XSS in PDF.js.
A flaw (CVE-2025-6218, CVSS 7.8) in WinRAR allows remote code execution via directory traversal when opening crafted archives. Update to 7.12 Beta 1 immediately!
A medium-severity flaw (CVE-2025-3415) in Grafana Alerting exposes sensitive DingDing contact point URLs to viewers. Update to patch or disable the integration
A high-severity flaw (CVE-2025-4922) in HashiCorp Nomad allows privilege escalation via ACL policy lookup. Upgrade to Nomad 1.10.2 (or later) immediately.
Trend Micro Apex Central has two critical pre-authentication RCE flaws (CVSS 9.8, CVE-2025-49219, CVE-2025-49220). Patch immediately to prevent remote takeover.
Apache CloudStack LTS updates patch five security flaws, including two critical vulnerabilities in Kubernetes and admin access, risking full system compromise.
A high-severity flaw (CVE-2024-43706) in Kibana's Synthetic Monitoring allows unauthorized access. Upgrade to 8.12.1 or apply mitigations immediately.
Apple patches a CoreAudio flaw exploited in the wild via malicious media files, enabling remote code execution. PoC now on GitHub.
A ZITADEL vulnerability allows host header injection to hijack user accounts via password reset links. Update to 3.2.2+ or configure proxy.
Two CVEs in TheGem WordPress theme let subscriber-level users upload malicious files and take over sites. Patch to version 5.10.3.1 now.
Urgent: SAP's May 2025 Security Patch Day reveals critical vulnerabilities! Learn about the latest threats and how to protect your systems. Act now to secure your SAP landscape