Do Son A critical flaw (CVE-2025-54371, CVSS 7.5) in the form-data package, used by Axios 1.10.0, allows attackers to predict multipart boundaries, risking HTTP parameter pollution and injection. Update to 1.11.0 now!
Vulnerability
High-Severity SQL Injection (CVE-2025-52914) in Mitel MiCollab Allows Data Access, Command Execution
High-Severity SQL Injection (CVE-2025-52914) in Mitel MiCollab Allows Data Access, Command Execution
Mitel issued patches for a high-severity SQL injection flaw (CVE-2025-52914) in MiCollab, allowing authenticated attackers to access user provisioning data and execute arbitrary database commands.
A critical flaw (CVE-2025-41240, CVSS 10.0) in Bitnami Helm charts exposes Kubernetes secrets via publicly accessible paths, allowing unauthenticated remote access. Update immediately!
Mitel warns of a critical authentication bypass vulnerability in MiVoice MX-ONE's Provisioning Manager, allowing unauthenticated attackers unauthorized access to accounts.
A high-severity flaw (CVE-2025-8069) in AWS Client VPN for Windows allows local users to escalate privileges due to an OpenSSL config file path vulnerability.
SonicWall SMA 100 series has buffer overflow and XSS flaws (CVSS 6.3-7.3) exploitable by unauthenticated attackers via the web interface. Update to 10.2.2.1-90sv immediately!
Weidmueller IE-SR-2TX series security routers have critical flaws (CVSS 9.8) allowing unauthenticated RCE and buffer overflows, risking industrial automation and critical infrastructure.
TP-Link warns of two critical command injection flaws (CVE-2025-7723, -7724) in VIGI NVRs, allowing remote attackers to execute arbitrary commands, even unauthenticated. Update immediately.
Synology BeeDrive desktop app for Windows has three high-severity vulnerabilities (CVSS 7.5-7.8) allowing local code execution and remote arbitrary file deletion.
Dahua IP cameras are vulnerable to two high-severity buffer overflow flaws (CVE-2025-31700, CVE-2025-31701) allowing remote attackers to crash devices or execute arbitrary code. Update firmware immediately.
18 severe vulnerabilities (CVSS up to 9.8) found in Samsung MagicINFO 9 Server allow RCE, web shell uploads, and auth bypass via hardcoded credentials. Update immediately!
GitLab patched multiple high-severity XSS and data exposure vulnerabilities in CE/EE, urging users to update to 18.2.1, 18.1.3, or 18.0.5.
A critical SharePoint Server RCE (CVE-2025-53770) is actively exploited. A Metasploit module is now public, amplifying the urgency for immediate patching.
SonicWall warns of CVE-2025-40599 in SMA 100 series, allowing authenticated admins to upload arbitrary files, potentially leading to RCE.
CISA and Schneider Electric warn of critical, actively exploited RCEs in EcoStruxure Power Operation (EPO), impacting industrial control systems. Public exploits are available.
CISA added four actively exploited vulnerabilities—including zero-days in CrushFTP, Chrome, and SysAid—to its KEV Catalog, urging immediate remediation for critical systems.
A critical vulnerability (CVE-2025-7783, CVSS 9.4) in the Form-Data JavaScript library allows multipart injection and potential RCE due to predictable boundary values.
Google released an urgent Chrome update fixing two high-severity type confusion vulnerabilities (CVE-2025-8010, CVE-2025-8011) in its V8 JavaScript engine. Update immediately!
A critical unauthenticated SSRF vulnerability (CVE-2025-54122, CVSS 10.0) in Manager.io's accounting software allows bypassing network isolation and exfiltrating sensitive data from cloud environments.
Cisco warns of active exploitation for three critical ISE flaws (CVSS 10.0), allowing unauthenticated RCE and full system control. Update ISE 3.3 and 3.4 immediately!
Kubernetes warns of CVE-2025-7342 (CVSS 8.1) in Image Builder. Default credentials in Windows VM images (Nutanix/OVA) allow unauthenticated root access to clusters. Patch immediately!
Sophos patched five flaws in Sophos Firewall, including two critical RCEs (CVE-2025-6704, CVE-2025-7624) allowing remote attackers to take control under specific conditions.