Do Son Google Chrome will distrust TLS certs from Chunghwa Telecom & NetLock starting Aug 1, 2025, due to compliance issues, impacting website access.
security
Netwrix warns of critical 10.0 CVSS flaws in Directory Manager v11, including a hard-coded password. Patch immediately to prevent unauthorized access and data breaches.
Microsoft Authenticator's password manager is being deprecated. Save new passwords until June 2025; migrate to Edge or export your data now!
A critical Icinga 2 vulnerability (CVSS 9.3) allows malicious certificate impersonation, affecting builds with older OpenSSL. Update now!
A critical XSS vulnerability (CVSS 9.1) in Argo CD allows attackers to hijack user sessions and control Kubernetes resources. Update to fix
Java applications face a critical risk! A flaw in Apache Commons BeanUtils (CVSS 8.8) can lead to arbitrary code execution. Update immediately.
CHOICEJACKING, a new USB attack, bypasses existing JuiceJacking mitigations on Android and iOS by simulating user input via malicious chargers.
Citrix has patched high-severity flaws in XenServer VM Tools for Windows that could allow attackers to compromise guest VMs. Update to version 9.4.1.
Amazon Redshift Python Connector has a high severity vulnerability allowing OAuth2 token interception due to missing SSL validation.
GIMP versions before 2.99.16 & 3.0.0 are vulnerable to RCE from crafted image files. Patch now to protect your system.
A critical flaw (CVE-2025-35003) in Apache NuttX RTOS allows RCE or DoS via crafted Bluetooth packets. Update to version 12.9.0 now.
A critical Canon printer vulnerability (CVE-2025-2146, CVSS 9.8) allows network attackers to execute arbitrary code. Update firmware now.
A critical pre-authentication RCE vulnerability in vBulletin 5.x and 6.x allows full server compromise. A PoC exploit is available.
An unauthenticated flaw in GNOME's remote desktop (CVE-2025-5024) allows attackers to repeatedly crash Linux environments, preventing recovery even after systemd restarts.
A Ghostscript vulnerability (CVE-2025-48708) embeds plaintext passwords in encrypted PDF files, undermining document security. Update now!
Critical NETGEAR flaw (CVE-2025-4978) allows full admin access via hidden backdoor. Exploit details and PoC analysis inside.
Canon urges users to mitigate high-severity flaws in a range of printers that could allow sensitive data extraction.
Deceptive VS Code extensions like 'solaibot' are stealing crypto wallet credentials, disabling Defender, and deploying persistent spyware on Windows.
A high-severity flaw (CVE-2025-48026) in Mitel OpenScape Xpressions allows unauthenticated attackers to read sensitive local files, including voicemail.
Grafana rushed an emergency patch for CVE-2025-4123, a high-severity XSS flaw that was made public. Upgrade now to prevent unauthorized access.
GitLab released urgent updates (18.0.1+) fixing high-severity flaws, including a DoS vulnerability (CVE-2025-0993) and a 2FA bypass (CVE-2024-12093).
A high-severity BIND DNS server vulnerability allows remote attackers to crash servers using malformed TSIG signatures. Urgent update advised.