Do Son A new security advisory reveals two high-severity flaws in FreePBX, including a stored XSS and a shared OAuth key that could allow for API token forgery and admin compromise.
Vulnerability
CISA adds three new vulnerabilities to its KEV Catalog, including flaws in the Linux kernel, Android Runtime, and Sitecore CMS. All are being actively exploited.
A critical flaw in Ruijie Reyee RG-ES series switches allows unauthenticated remote attackers to modify login credentials and gain full admin access. CVE-2025-56752 has a CVSS 9.4 score.
A new GreyNoise report warns of two massive scanning spikes targeting Cisco ASA devices, raising concerns that attackers may be preparing to exploit a new vulnerability.
A critical flaw in ABB ASPECT BMS (CVE-2025-53187) allows unauthenticated remote attackers to achieve RCE with a CVSS 9.8 score. Admins must patch or disconnect systems.
A critical RCE flaw (CVSS 10.0) in the DeepDiff Python library allows for arbitrary code execution via class pollution. A PoC is public, and patching is urgent.
The GNU Guix team has issued an urgent advisory for a privilege escalation flaw in guix-daemon. Local users could gain control of build outputs, risking system integrity.
A new report reveals a critical flaw in the AI supply chain where attackers can hijack model namespaces on Hugging Face to deploy malicious models on major cloud platforms.
A new report reveals a high-severity SQL injection flaw (CVE-2025-57833) in Django's FilteredRelation. The bug allows attackers to manipulate queries.
A coordinated disclosure by Mandiant and Sitecore has revealed the active exploitation of a critical configuration vulnerability...
CISA has added two TP-Link router flaws to its KEV Catalog, including an RCE vulnerability in end-of-life devices. Both are being actively exploited in the wild.
A set of ten critical flaws, dubbed "Frostbyte10," were found in industrial controllers. These bugs could allow attackers to tamper with global food and medicine supply chains.
The Envoy Project has patched two new vulnerabilities: a use-after-free bug that can lead to DoS (CVE-2025-54588) and a session-hijacking flaw in its OAuth2 filter.
Google has released Chrome 140, patching six vulnerabilities including a high-severity use-after-free flaw in the V8 JavaScript engine that could allow for remote code execution.
A new report reveals a critical one-click RCE flaw (CVSS 8.8) in the Dive desktop app. A malicious URL could hijack a user's machine. Update to v0.9.4 now.
A critical RCE flaw (CVE-2025-53772) in IIS Web Deploy allows an authenticated attacker to execute arbitrary code. A PoC is public, and patching is urgent.
NVIDIA has released a critical security update for BlueField, DOCA, and other products, fixing multiple high-severity flaws that could lead to privilege escalation and DoS.
Google's new Android update patches dozens of flaws, including two actively exploited vulnerabilities and a critical RCE that can be triggered without user interaction.
CISA warns of a critical flaw (CVE-2025-9696) in SunPower PVS6 solar inverters. Hardcoded Bluetooth encryption parameters allow attackers to gain full control.
CISA adds two flaws to its KEV Catalog: a TP-Link factory reset flaw and a WhatsApp zero-click vulnerability used in targeted spyware attacks. Patching is urgent.
A critical flaw (CVE-2025-6507) in the H2O-3 machine learning platform allows attackers to bypass security filters, leading to remote code execution.
A new Linux kernel flaw (CVE-2025-38617) in the af_packet subsystem can cause a kernel panic. A PoC has been released, and admins are urged to update patched kernels.