Do Son A new Linux kernel vulnerability, CVE-2025-21692, can be exploited to achieve remote code execution by manipulating the ETS qdisc, a simple but critical flaw.
Vulnerability
A critical vulnerability (CVE-2025-9242) in WatchGuard's Fireware OS could allow an unauthenticated remote attacker to execute arbitrary code.
NVIDIA has released a critical security update for its Triton Inference Server, fixing multiple high-severity flaws that could lead to remote code execution and DoS.
HPE Aruba Networking has patched multiple high-severity flaws in its SD-WAN gateways. The bugs could lead to RCE, privilege escalation, and unauthorized access.
A medium-severity vulnerability (CVE-2025-9708) in the Kubernetes C# client allows MITM attacks and API impersonation. Update now to patch.
A new Linux kernel flaw, CVE-2025-38501, exposes KSMBD servers to unauthenticated remote DoS attacks. A public PoC is available now.
Two medium-severity flaws in Spring Security and the Spring Framework allow authorization bypasses in applications that use method-level security on generic types.
A new report details a 0-click RCE exploit chain in the Linux kernel's ksmbd module that allows an authenticated user to gain root access. A PoC has been published.
Samsung has released an emergency patch for a critical zero-day vulnerability (CVE-2025-21043) actively exploited in Android devices. Update now to protect against RCE attacks.
A critical flaw (CVE-2025-58434) in FlowiseAI allows unauthenticated attackers to hijack any account. The bug has a CVSS 9.8 score, and a PoC has been released.
Two critical vulnerabilities (CVSS 10 & 9.8) in Digiever NVRs allow unauthenticated attackers to steal credentials and execute commands. Update your firmware immediately.
A critical flaw in LangChainGo, a popular LLM framework, allows attackers to read sensitive files via server-side template injection. A patch has been released.
Researchers have found a new Spectre-like attack called VMScape that allows a malicious VM to steal data from a hypervisor on Intel and AMD CPUs.
New patches for CUPS, the open-source Linux printing system, fix two flaws that can lead to remote DoS and authentication bypass.
A new vulnerability (CVE-2025-58754) in the Axios library could allow attackers to crash Node.js processes via crafted data: URIs, leading to a denial-of-service.
CISA adds a critical deserialization flaw in Dassault Systèmes DELMIA Apriso (CVE-2025-5086) to its KEV catalog, with active exploitation confirmed.
A local privilege escalation flaw in PyInstaller (CVE-2025-59042) could let attackers execute code. Check if your apps are at risk.
A critical Angular SSR vulnerability (CVE-2025-59052) could expose user data. Learn about the flaw, affected versions, and how to protect your application.
CERT/CC warns of critical flaws in Sunshine for Windows, including unquoted service path and DLL hijacking, that allow local attackers to escalate privileges.
A high-severity DoS flaw (CVE-2025-8696) in Stork UI allows unauthenticated attackers to crash the server with excessive data, leading to resource exhaustion.
Australian authorities issue an urgent alert on a critical SonicWall SSL VPN flaw actively exploited by Akira ransomware, urging immediate patching.
A critical flaw (CVE-2025-58063) in the CoreDNS etcd plugin allows attackers to pin DNS cache entries for years, causing a denial of service for service updates.