Do Son A critical flaw (CVE-2025-57808) in ESPHome allows an attacker on the local network to bypass authentication entirely, gaining control of smart home devices.
Vulnerability
Qualcomm's latest bulletin patches two critical modem flaws (CVE-2025-21483 & CVE-2025-27034) with CVSS 9.8 scores, enabling remote code execution via rogue cellular base stations.
HashiCorp has issued a security advisory for a high-severity DoS flaw (CVE-2025-6203) in Vault. A malicious JSON payload could make a server unresponsive.
A new report reveals a critical flaw in Harness Gitness that allows authenticated attackers to write arbitrary files to the server, risking a full system compromise.
A critical flaw in a Seiko Solutions networking device allows unauthenticated remote attackers to execute commands with root privileges. The issue has a CVSS score of 9.8.
MediaTek's September security bulletin warns of high-severity flaws in its modem that can be exploited by rogue cellular base stations for remote privilege escalation or DoS.
A new high-severity vulnerability in SUSE Rancher's Fleet engine (CVE-2024-52284) exposes sensitive Helm chart credentials in plain text.
A critical vulnerability in ImageMagick's BMP encoder (CVE-2025-57803) could allow remote code execution. Update your 32-bit builds immediately.
A critical flaw in NeuVector (CVE-2025-8077) allows attackers to bypass authentication with a hardcoded password, exposing Kubernetes clusters to full compromise.
A high-severity DoS flaw (CVE-2024-58259) in Rancher Manager allows attackers to crash servers by sending oversized API requests. Admins are urged to patch immediately.
A critical RCE flaw (CVE-2024-13986) in Nagios XI allows an authenticated attacker to upload and execute a malicious PHP shell, taking control of the server.
A new vulnerability (CVE-2025-8067) in the Linux UDisks daemon allows unprivileged users to escalate privileges or cause a denial of service. Admins are urged to patch.
IBM has issued a security advisory for a SQL injection flaw (CVE-2025-0165) in watsonx Orchestrate. The high-severity bug could allow attackers to manipulate backend databases.
A high-severity DoS flaw (CVE-2025-58047) in Volto, the frontend for Plone CMS, allows an unauthenticated user to crash the server with a single crafted URL.
A new Active Directory flaw, BadSuccessor, allows low-privileged users to become Domain Admins. Akamai researchers warn that the technique remains a threat even after patching.
QNAP has patched a critical improper authentication flaw (CVE-2025-52856) in its QVR firmware with a CVSS score of 9.3, allowing remote attackers to bypass security.
A critical zero-click flaw in WhatsApp (CVE-2025-55177), paired with an Apple zero-day, was used in sophisticated attacks. All users must update now.
Hikvision has issued an advisory for three flaws in its HikCentral products. The most severe, with a CVSS of 8.6, allows an unauthenticated user to get admin access.
ImageMagick has a format string bug (CVE-2025-55298) that can lead to RCE. A PoC is public, and an urgent patch is available for versions 7.1.2-2 and 6.9.13-28.
D-Link warns of a critical command injection flaw (CVSS 9.8) in its EOL DIR-series routers. A PoC is public, and since no patch is available, devices must be replaced.
A critical zero-day (CVE-2025-57819) in FreePBX with a CVSS 10.0 score is being actively exploited. The flaw allows unauthenticated RCE, and admins must patch immediately.
A critical SQL injection flaw (CVE-2025-50979) in NodeBB allows remote attackers to access sensitive data. Admins are urged to patch immediately.