Do Son Splunk issued patches for six flaws, including a High-severity blind SSRF (CVE-2025-20371) and XSS issues that could allow attackers to access sensitive data and crash the platform.
ssrf
The Apache Software Foundation has published a new security advisory disclosing three vulnerabilities in Apache Kylin, a...
A high-severity flaw (CVE-2025-58179) in Astro's Cloudflare adapter allows attackers to bypass domain restrictions, leading to SSRF and XSS attacks.
A new report reveals a critical SSRF vulnerability in the PhpSpreadsheet library. The flaw could allow attackers to access internal networks and sensitive data.
Xerox has patched two critical vulnerabilities (CVE-2025-8355, CVE-2025-8356) in FreeFlow Core 8.0.4, allowing attackers to exploit XML and path traversal flaws to achieve RCE and SSRF.
A critical SSRF vulnerability (CVE-2025-54381) in BentoML's file upload handling allows unauthenticated remote attackers to perform internal network reconnaissance and steal cloud metadata credentials from AI applications.
Salesforce patched eight critical flaws in Tableau Server, including RCE, database exposure, and SSRF vulnerabilities, urging users to update immediately.
18 severe vulnerabilities (CVSS up to 9.8) found in Samsung MagicINFO 9 Server allow RCE, web shell uploads, and auth bypass via hardcoded credentials. Update immediately!
A critical unauthenticated SSRF vulnerability (CVE-2025-54122, CVSS 10.0) in Manager.io's accounting software allows bypassing network isolation and exfiltrating sensitive data from cloud environments.
Apache HTTP Server 2.4.64 patches 8 vulnerabilities, including HTTP Response Splitting, SSRF, DoS, and TLS desync attacks. Upgrade immediately!
Schneider Electric warns of critical flaws (CVSS 10.0 RCE, SSRF, EoP) in EcoStruxure IT Data Center Expert. Patch to v9.0 immediately to prevent data center disruption.
JPCERT/CC warns of critical flaws in Nimesa Backup and Recovery (CVE-2025-48501, CVSS 9.8 RCE; CVE-2025-53473 SSRF). Unsupported versions pose severe risk to AWS data.
CISA warns of critical flaws in ControlID iDSecure On-premises, including SQL Injection, auth bypass, and SSRF, risking vehicle access control systems.
Elastic patches two Kibana flaws: CVE-2025-2135 (CVSS 9.9) allows heap corruption/RCE via Chromium, and CVE-2025-25012 (CVSS 4.3) is an open redirect/SSRF risk.
A critical SSRF flaw (CVE-2025-6087) in @opennextjs/cloudflare allows unauthenticated users to proxy arbitrary remote content via /_next/image endpoint.
Apache Kafka fixes CVEs exposing clients to RCE, SSRF, and file read attacks. Update to secure versions and review JAAS settings immediately.
Esri patches a critical SSRF vulnerability in Portal for ArcGIS, allowing unauthenticated remote attackers to bypass protections and access internal services.
CVE-2025-4641: XXE flaw in popular WebDriverManager library (CVSS 9.3) exposes test systems to file leaks and SSRF. Patch to 6.0.2 now.
SonicWall fixes CVE-2025-40595, a high-severity SSRF flaw in SMA1000 appliances. Patch now to block remote encoded URL exploitation.
JPCERT reports critical flaws in a-blog cms, including CVE-2025-36560 (CVSS 9.2). Attackers could hijack sessions and access sensitive data.
Microsoft patched critical Azure & Power Apps security flaws before exploitation. No user action needed. Stay informed on cloud security.
SonicWall fixes CVE-2025-2170, an SSRF flaw in SMA1000 appliances. Users urged to update to platform-hotfix 12.4.3-02925 or later to stay secure.