Do Son A critical vulnerability (CVE-2025-20265) in Cisco Secure Firewall Management Center allows unauthenticated attackers to execute commands with high privilege.
Vulnerability
Apache Tomcat has released updates for two serious flaws: a session fixation vulnerability and a "MadeYouReset" DoS vulnerability affecting multiple versions.
A new vulnerability, "MadeYouReset," has been discovered in HTTP/2, allowing attackers to exploit stream resets to launch devastating denial-of-service attacks.
A critical 9.8-rated vulnerability in the popular "Database for Contact Form 7" plugin could let unauthenticated attackers delete files and gain full control of sites.
Siemens has issued a high-severity alert for a critical vulnerability in its SIMATIC RTLS Locating Manager. The flaw could allow remote code execution with high privileges.
A new zero-click NTLM flaw (CVE-2025-50154) bypasses Microsoft's patch for a similar vulnerability, allowing attackers to leak credentials and drop malware.
GitLab has released patches for multiple high-severity vulnerabilities, including several XSS flaws that could lead to account takeover. All users should update immediately.
Chrome 139 fixes high-severity bugs in V8, libaom, and ANGLE that attackers could exploit. Update your browser now to stay protected.
SAP’s August 2025 Patch Day fixes critical code injection flaws in S/4HANA and SLT that could allow full ERP compromise via RFC exploits.
A critical flaw in Apache bRPC's Redis parser (CVE-2025-54472) allows unauthenticated remote attackers to crash services via a memory allocation bug. Update to 1.14.1 immediately!
Google has paid out its highest-ever Chrome bug bounty of $250,000 for a critical sandbox escape flaw that could bypass multiple security layers.
A new "EPM Poisoning" attack technique exploits a Windows RPC flaw (CVE-2025-49760) to hijack services, enabling unprivileged users to steal machine credentials and compromise Active Directory.
A critical flaw (CVE-2025-24103) in macOS InstallAssistant allows a normal user to bypass TCC, exposing private data. A PoC is public, urging users to update to 15.3.
CISA warns of a critical authentication bypass flaw (CVE-2025-8284, CVSS 9.8) in Packet Power devices, allowing unauthenticated remote attackers to gain full access.
A critical vulnerability (CVE-2025-55188, CVSS 2.7) in 7-Zip allows remote attackers to perform arbitrary file writes via a crafted archive, potentially leading to code execution.
Xerox has patched two critical vulnerabilities (CVE-2025-8355, CVE-2025-8356) in FreeFlow Core 8.0.4, allowing attackers to exploit XML and path traversal flaws to achieve RCE and SSRF.
CISA warns of a critical authentication bypass flaw (CVE-2025-5095, CVSS 9.8) in ARC Solo devices, allowing attackers to change passwords and take full remote control without authentication.
ESET warns of an actively exploited WinRAR zero-day (CVE-2025-8088). The path traversal flaw allows attackers to execute code by crafting malicious archives.
CISA warns of critical flaws in EG4 Electronics inverters (CVSS up to 9.2), allowing attackers to install malicious firmware, hijack control, and disrupt power generation.
A critical Ruby JWE vulnerability (CVE-2025-54887, CVSS 9.1) allows attackers to bypass authentication tag validation in AES-GCM, potentially leading to data decryption and integrity loss.
Ubiquiti has issued an advisory for a critical flaw (CVE-2025-24285, CVSS 9.8) in its UniFi Connect EV Stations, allowing remote command injection and unauthenticated RCE.
Microsoft warns of a critical flaw (CVE-2025-53786) in Exchange hybrid environments, allowing attackers with on-prem admin access to escalate privileges in Exchange Online.