Do Son JPCERT/CC warns of critical flaws (CVSS 9.8) in SATO industrial label printers that allow unauthenticated remote attackers to upload malicious Lua scripts for root access.
Vulnerability
CISA issues an urgent warning about "ToolShell," a sophisticated exploit chain targeting SharePoint servers with multiple vulnerabilities to install webshells and steal crypto keys.
A critical PHP object injection flaw (CVE-2025-52709, CVSS 9.8) in Everest Forms allows RCE when an admin views form submissions on PHP versions below 7.1. Update to v3.2.3 immediately.
CISA warns of critical flaws in Tigo Energy's Cloud Connect Advanced devices, including hard-coded credentials and command injection, that could allow remote attackers to take full control of solar systems.
CISA adds three D-Link vulnerabilities (CVE-2020-25078, -25079, -2022-40799) to its KEV Catalog, confirming active exploitation of EOL IP cameras.
A critical vulnerability (CVE-2025-54594, CVSS 9.1) in React Native Bottom Tabs’ GitHub Actions allowed RCE and secret exfiltration. The flaw was patched, and no packages were affected.
Adobe released urgent patches for two critical flaws (CVE-2025-54253, -54254) in AEM Forms on JEE, allowing unauthenticated RCE & file reads, with public PoCs available.
A critical server-side template injection flaw (CVE-2024-23692) in Rejetto HFS 2.x is actively exploited to deploy ransomware and trojans at scale. Update or retire the service immediately.
Rockwell Automation's Arena Simulation software has three high-severity memory abuse flaws that could allow RCE or data leaks when opening a crafted file. Update immediately.
Trend Micro warns of two critical RCE flaws (CVE-2025-54948, -54987) in Apex One (on-prem) actively exploited in the wild. A fix tool is available, but disables remote agent installs.
Proton has patched a critical flaw in its iOS Authenticator app (v1.1.1) that logged TOTP secrets in plaintext. Users are urged to update immediately to secure their accounts.
A critical SQL injection flaw (CVE-2025-54119, CVSS 10.0) in ADOdb’s SQLite3 driver allows arbitrary SQL execution via improperly escaped table names.
Google's August 2025 Android Security Bulletin addresses a critical RCE flaw (CVE-2025-48530) in the core System component, which requires no user interaction for exploitation. Update now!
NVIDIA has patched multiple critical flaws (CVSS 9.8) in its Triton Inference Server. A vulnerability chain allows unauthenticated attackers to gain RCE and seize AI servers.
Dell patched a critical flaw (CVE-2025-36594) in DD OS allowing unauthenticated remote auth bypass. DDSH CLI flaws (CVE-2025-30096-30099) also patched.
MediaTek has patched out-of-bounds write vulnerabilities in its chipsets, exposing smartphones and IoT devices to local privilege escalation. Update firmware immediately.
A study reveals Python's ecosystem is a "labyrinth of dependencies" that propagates vulnerabilities. Over 145,000 packages are at risk, with urllib3 accounting for 41% of all exposures.
CERT/CC reveals critical flaws in Partner Software and Partner Web, including default admin credentials and XSS, that allow unauthenticated RCE on municipal and state systems.
Palo Alto's Unit 42 reveals a sophisticated cyberespionage campaign by Liminal Panda (CL-STA-0969) targeting Southwest Asian telecom infrastructure with custom backdoors.
Cursor, the AI code editor, has patched two severe vulnerabilities (CVE-2025-54135, CVE-2025-54136) that allowed remote code execution via prompt injection and MCP trust bypass.
A critical heap buffer overflow (CVE-2025-54574, CVSS 9.3) in Squid allows unauthenticated RCE and information leakage when processing URN requests.
A critical flaw (CVE-2025-6000) in HashiCorp Vault allows privileged operators to achieve remote code execution on the host via misconfigured plugin directories.