Do Son Elastic patched five flaws in Kibana/Elasticsearch, including three Critical XSS issues (CVE-2025-25009) and credential leaks, urging immediate upgrades to v8.18.8+.
security update
IBM patched a Critical (CVSS 9.3) LPE flaw (CVE-2025-36356) in Verify Access/Identity Access that allows locally authenticated users to escalate privileges to root. Update to v10.0.9.0-IF3 now.
A flaw in the Unity Runtime (CVE-2025-59489) allows local code execution in games via DLL injection through the Android intent handler. Developers must rebuild their apps.
Yoast SEO Premium has a stored XSS flaw (CVE-2025-11241) that allows Contributor+ users to inject malicious scripts into posts. All users are urged to upgrade to v26.0 immediately.
Google promoted Chrome 141 to Stable, patching 21 flaws including a High-severity Heap Buffer Overflow (CVE-2025-11205) in WebGPU that could lead to RCE.
Splunk issued patches for six flaws, including a High-severity blind SSRF (CVE-2025-20371) and XSS issues that could allow attackers to access sensitive data and crash the platform.
The Django team released urgent updates (v5.2.7, 5.1.13, 4.2.25) to fix a High-severity SQL Injection flaw (CVE-2025-59681) affecting QuerySet methods in MySQL/MariaDB.
NVIDIA patched multiple flaws, including a critical DLS bug (CVSS 8.7) allowing unauthenticated access and DoS, and a privilege escalation flaw (CVSS 7.8) in the NVIDIA App.
A critical flaw (CVE-2025-7493) in FreeIPA allows authenticated users to exploit Kerberos alias checks to gain full domain administrator privileges. Patch to v4.12.5 now.
Western Digital has patched a critical RCE flaw in its My Cloud NAS. The vulnerability allows remote attackers to execute arbitrary commands via a crafted HTTP request.
Broadcom patches three vulnerabilities in VMware vCenter and NSX. The flaws could lead to SMTP header injection and username enumeration, increasing the risk of unauthorized access.
SUSE patches three flaws in Rancher Manager. A phishing vulnerability (CVSS 8.1) can steal admin tokens, while a DoS flaw can lock out administrators.
Cisco patches CVE-2025-20362, a medium-high zero-day vulnerability in ASA/FTD VPN web servers that is being exploited to gain unauthorized access to restricted resources.
GitLab urges immediate upgrade to patch versions 18.4.1+ for high-severity DoS flaws that allowed unauthenticated attackers to crash self-managed instances.
NVIDIA released an urgent update for its Megatron-LM LLM framework, patching four high-severity code injection flaws that could allow attackers to compromise AI workflows.
Google has released an urgent update for Chrome, patching three high-severity flaws in its V8 JavaScript engine, two of which were discovered by AI.
Google has released an urgent Chrome update, patching a V8 zero-day (CVE-2025-10585) being exploited in the wild, along with other high-severity flaws.
Microsoft's latest security updates are causing SMBv1 connectivity issues. Learn why and find a temporary fix for your file sharing problems.
A new report reveals a high-severity SQL injection flaw (CVE-2025-57833) in Django's FilteredRelation. A PoC is public with technical details. Patching is urgent.
Google has released Chrome 140, patching two vulnerabilities including a critical use-after-free flaw in ServiceWorker and a high-severity flaw in Mojo.
A new report reveals a high-severity SQL injection flaw (CVE-2025-57833) in Django's FilteredRelation. The bug allows attackers to manipulate queries.
Google has released Chrome 140, patching six vulnerabilities including a high-severity use-after-free flaw in the V8 JavaScript engine that could allow for remote code execution.