Do Son Kaspersky's Q2 2025 report reveals a surge in vulnerabilities, with attackers exploiting classic flaws in Windows and WinRAR while adapting to AI and low-code platforms.
Vulnerability
Cisco has issued a security advisory for a high-severity DoS vulnerability (CVE-2025-20241) in its Nexus switches that could allow an unauthenticated attacker to crash a device.
Dell has released a critical security advisory for ThinOS 10, with a CVSS 9.6 flaw that allows unauthenticated remote attackers to bypass protection mechanisms.
A new report reveals a high-severity flaw (CVE-2025-40779) in the Kea DHCP server that allows a single crafted packet to crash the service, leading to a DoS condition.
NVIDIA has released a critical security update for its NeMo Framework, patching four high-severity flaws that could allow attackers to execute code and tamper with AI pipelines.
A zero-day authentication bypass flaw (CVE-2025-54309) in CrushFTP is being actively exploited in the wild. A PoC is available, and an urgent patch is required.
NVIDIA has issued a high-severity security update for a flaw (CVE-2025-23307) in NeMo Curator. The vulnerability allows code injection and could compromise AI training pipelines.
A critical command injection flaw (CVE-2025-57105) has been found in D-Link's end-of-life DI-7400G+ router series. Because the devices are unsupported, no patch is coming.
A new report reveals that Google's AI agent, Big Sleep, discovered and fixed a critical use-after-free vulnerability (CVE-2025-9478) in Chrome's ANGLE engine.
A critical flaw (CVE-2025-41702) in Welotec egOS allows unauthenticated attackers to impersonate administrators, gain full control, and disrupt industrial systems.
The Cloud Software Group has released urgent updates for NetScaler ADC and Gateway to patch a zero-day (CVE-2025-7775) being actively exploited in the wild.
A new Google report reveals that its AI agent, Big Sleep, discovered and foiled a critical SQLite flaw (CVE-2025-6965) before attackers could exploit it.
The Langflow project has issued an important security advisory regarding a newly discovered vulnerability that poses a...
A new report reveals a critical SSRF vulnerability in the PhpSpreadsheet library. The flaw could allow attackers to access internal networks and sensitive data.
Two critical flaws in the open-source BI tool DataEase allow attackers to achieve remote code execution and arbitrary file writes, exposing unpatched systems to compromise.
CISA has added two Citrix and one critical Git vulnerability to its KEV Catalog, warning that all three flaws are being actively exploited by malicious actors.
TP-Link has patched a high-severity flaw (CVE-2025-8627) in its KP303 Smart Plug. The vulnerability allows remote attackers to issue unauthenticated commands.
A new Rapid7 report reveals four critical flaws in Securden's Privileged Access Manager, including authentication bypass and RCE, that could expose passwords and secrets.
A critical zero-day vulnerability (CVE-2025-5419) in Chrome's V8 engine is being actively exploited. Users must update their browser immediately to prevent attacks.
Salesforce has patched several critical vulnerabilities in Tableau Server, including a Type Confusion flaw with a CVSS score of 9.6 that could allow for local code inclusion.
IBM has issued a critical security bulletin for a flaw (CVE-2025-36157) in its Jazz Team Server. The vulnerability could allow unauthenticated remote attackers to take control of affected systems.
A critical vulnerability in Plex Media Server, with a CVSS score of 10.0, has been patched. Users are urged to update immediately to prevent exploitation.