Do Son CISA issues an urgent advisory on CVE-2025-8286, a critical vulnerability in Güralp FMUS seismic devices exposing an unauthenticated Telnet interface that allows remote attackers to reconfigure, tamper with, or factory reset devices.
Vulnerability
Rtpengine's critical flaws (CVE-2025-53399, CVSS 9.3) allow attackers to intercept or inject audio into active VoIP calls, even without a MitM position, by exploiting SRTP validation.
A critical vulnerability (CVE-2025-46811, CVSS 9.8) in SUSE Manager allows unauthenticated remote command execution with root privileges on all managed Linux clients.
A critical vulnerability (CVE-2025-54576, CVSS 9.1) in OAuth2-Proxy allows attackers to bypass authentication by manipulating query parameters that match skip_auth_routes regex patterns.
Elastic patched two local privilege escalation flaws (CVE-2025-0712, CVE-2025-25011) in APM Server and Beats for Windows, allowing local attackers to gain SYSTEM privileges.
A critical SSRF vulnerability (CVE-2025-54381) in BentoML's file upload handling allows unauthenticated remote attackers to perform internal network reconnaissance and steal cloud metadata credentials from AI applications.
Critical Flaw in Wix’s New AI Platform Base44 Allowed Unauthorized Access to Private Enterprise Apps
Critical Flaw in Wix’s New AI Platform Base44 Allowed Unauthorized Access to Private Enterprise Apps
Wiz Research uncovered a critical flaw in Wix's new AI platform, Base44, that allowed unauthorized access to private enterprise applications and sensitive data by bypassing SSO.
A critical RCE flaw (CVE-2025-5394, CVSS 9.8) in the Alone WordPress theme allows unauthenticated attackers to upload arbitrary files and gain full site control. Exploitation is confirmed in the wild.
The EOL TP-Link Archer C50 router has a critical hardcoded DES key (CVE-2025-6982), allowing attackers to decrypt sensitive configuration files, including admin credentials and Wi-Fi passwords.
BeyondTrust patches two high-severity LPE flaws (CVE-2025-2297, CVE-2025-6250) in Privilege Management for Windows, allowing local attackers to gain SYSTEM privileges via user profile manipulation and WMIC exploit.
SonicWall discloses CVE-2025-40600, a critical format string vulnerability in SonicOS SSL VPN, allowing unauthenticated remote DoS attacks on Gen7 firewalls. Update to 7.3.0-7012 or later.
Google released a Chrome Stable Channel update patching CVE-2025-8292, a high-severity Use-After-Free vulnerability in its Media Stream component. Update immediately!
Microsoft discovered "Sploitlight" (CVE-2025-31199), a macOS flaw exploiting Spotlight plugins to bypass TCC, leading to private data exfiltration, including Apple Intelligence cached info.
ASUS has patched two high-severity flaws (CVE-2025-4569, CVE-2025-4570) in MyASUS, stemming from insecure token storage that could lead to unauthorized access. Update immediately!
A vulnerability (CVE-2025-8194, CVSS 7.5) in Python's tarfile module allows attackers to cause infinite loops and DoS by processing maliciously crafted archives. Patch immediately!
A critical vulnerability (CVE-2025-54419, CVSS 10.0) in Node-SAML allows attackers to bypass SAML 2.0 authentication by manipulating unsigned assertion data.
A critical command injection flaw (CVE-2025-54418, CVSS 9.8) in CodeIgniter's ImageMagick handler allows remote code execution via malicious filenames or text.
A critical command injection flaw (CVE-2025-54416) in tj-actions/branch-names GitHub Action allows arbitrary code execution in workflows, affecting over 5,000 public repositories.
Salesforce patched eight critical flaws in Tableau Server, including RCE, database exposure, and SSRF vulnerabilities, urging users to update immediately.
A critical privilege escalation flaw (CVE-2025-6241) in Lakeside Software's SysTrack allows low-privileged local users to gain SYSTEM access via DLL hijacking. Patch immediately.
A critical flaw (CVE-2025-54369) in Node-SAML allows attackers to bypass SAML 2.0 authentication by manipulating unsigned assertion data. Update to v5.1.0 immediately!
NVIDIA released critical security updates for GPU Display Drivers and vGPU software, patching 14 vulnerabilities that could lead to code execution, privilege escalation, or data leaks.