Do Son NVIDIA has released an update for its NVDebug tool, patching three high-severity vulnerabilities that could lead to code execution and privilege escalation.
Vulnerability
GitLab has released emergency patches for multiple vulnerabilities, including two high-severity flaws that could lead to denial of service and server-side request forgery.
A new report reveals a high-severity SQL injection flaw (CVE-2025-57833) in Django's FilteredRelation. A PoC is public with technical details. Patching is urgent.
Sophos has patched a critical authentication bypass flaw (CVE-2025-10159) with a CVSS 9.8 score in its AP6 wireless access points. Admins are urged to update now.
Microsoft's September Patch Tuesday addresses 86 flaws, including two zero-days and nine critical vulnerabilities in Windows, Office, Hyper-V, and Azure.
Google has released Chrome 140, patching two vulnerabilities including a critical use-after-free flaw in ServiceWorker and a high-severity flaw in Mojo.
Siemens has disclosed a critical flaw in its SIVaaS platform. A network share is exposed without authentication, allowing unauthenticated attackers to access or alter sensitive data.
CERT/CC warns of critical flaws in the Hiawatha web server. The vulnerabilities could allow attackers to bypass authentication and hijack sessions.
Siemens has disclosed a critical flaw in its SIVaaS platform. A network share is exposed without authentication, allowing unauthenticated attackers to access or alter sensitive data.
Ivanti has released a security update for Endpoint Manager, patching two high-severity RCE flaws (CVSS 8.8) that could allow unauthenticated attackers to execute code.
A critical CSRF flaw in Rockwell Stratix switches (CVE-2025-7350) could allow unauthenticated remote attackers to achieve RCE. The flaw has a CVSS score of 9.6.
Today, SAP released 21 new Security Notes and 4 updates as part of its monthly Security Patch...
A critical SQL injection flaw (CVE-2025-58450) in pREST allows attackers to read sensitive files, steal credentials, and manipulate databases. Patching is urgent.
Adobe has released an emergency patch for a critical Magento flaw, SessionReaper (CVE-2025-54236). The bug could allow automated attacks against thousands of online stores.
A critical flaw in Spring Cloud Gateway (CVE-2025-41243) has a CVSS 10.0 score. The bug allows property modification when actuator endpoints are exposed. Update now.
A high-severity vulnerability (CVE-2025-9636) in pgAdmin could allow attackers to hijack OAuth flows, leading to account takeover and data breaches.
A critical vulnerability (CVE-2025-57807) was found in ImageMagick's blob subsystem, allowing attackers to corrupt memory and potentially execute arbitrary code.
A new vulnerability in Apache Jackrabbit (CVE-2025-58782) exposes enterprise systems to JNDI injection, which could lead to remote code execution.
Progress Software has patched a high-severity RCE flaw (CVE-2025-7388) in OpenEdge AdminServer. The bug allows authenticated attackers to execute commands via Java RMI.
A high-severity flaw (CVE-2025-9566) in Podman allows malicious containers to overwrite host files via a symlink traversal attack. A patch is available in Podman v5.6.1.
A critical flaw in the cJSON library (CVE-2025-57052) allows attackers to bypass array bounds checking with a malformed JSON pointer. The bug has a CVSS 9.8 score.
A high-severity flaw (CVE-2025-58179) in Astro's Cloudflare adapter allows attackers to bypass domain restrictions, leading to SSRF and XSS attacks.