Do Son Nokia's WaveSuite NOC platform has two severe command injection vulnerabilities (CVE-2025-24938, CVE-2025-24936) allowing remote code execution, even with low privileges.
Vulnerability
wolfSSL 5.8.2 patches four vulnerabilities, including a critical Apple trust store bypass (CVE-2025-7395) and predictable randomness after fork(), impacting secure communications.
JPCERT/CC details a sophisticated, ongoing malware campaign exploiting Ivanti Connect Secure (CVE-2025-0282, -22457) using MDifyLoader, Cobalt Strike, vshell, and Fscan for stealthy persistent access.
Apache Jena versions up to 5.4.0 are vulnerable (CVE-2025-49656, -50151), allowing admin users to compromise the server file system and manipulate configurations.
Sophos has patched three high-severity LPE vulnerabilities in Intercept X for Windows (CVE-2024-13972, CVE-2025-7433, CVE-2025-7472), allowing local users to gain SYSTEM privileges.
A critical RCE (CVE-2025-54068) in Livewire v3.6.3 and earlier allows unauthenticated attackers to execute arbitrary code on millions of Laravel applications. Update now!
Two new medium-severity vulnerabilities (CVE-2025-53816, -53817) in 7-Zip versions prior to 25.0.0 risk memory corruption and denial of service. Update immediately.
An unauthenticated SharePoint RCE chain dubbed ToolShell (CVE-2025-49704, CVE-2025-49706) is being actively exploited globally, granting attackers full control of on-premise servers.
Lenovo issued patches for three vulnerabilities in Lenovo Vantage (CVE-2025-6230, CVE-2025-6231, CVE-2025-6232) allowing local privilege escalation on PCs. Update immediately.
Microsoft warns of active zero-day exploitation (CVE-2025-53770, CVSS 9.8) in on-premises SharePoint Server. No patch is available, but mitigations are provided.
CISA added CVE-2025-25257, a critical FortiWeb SQL injection vulnerability (CVSS 9.6), to its KEV Catalog, confirming active exploitation in the wild. Update immediately!
CrushFTP has issued an urgent advisory for CVE-2025-54309, a critical zero-day allowing remote exploitation via HTTP(S), already being actively used in the wild.
NetSPI uncovered CVE-2025-4660 in Forescout SecureConnector, allowing unauthenticated attackers to hijack endpoints remotely via a misconfigured named pipe.
Nvidia released patches for critical vulnerabilities (CVE-2025-23270, CVE-2025-23269) in Jetson Linux and IGX, allowing RCE, data tampering, and info disclosure.
Grafana Labs issued urgent patches for high-severity XSS (CVE-2025-6023) and medium-severity open redirect (CVE-2025-6197) vulnerabilities, impacting its observability platform.
Ubiquiti warns of CVE-2025-27212, a critical (CVSS 9.8) command injection vulnerability in UniFi Access devices, enabling unauthenticated RCE on the management network.
A critical RCE (CVE-2025-34300, CVSS 10.0) in Lighthouse Studio's Perl CGI scripts allows unauthenticated attackers to execute arbitrary code on web servers hosting surveys.
ISC warns of two high-impact vulnerabilities in BIND preview editions (CVE-2025-40776, CVE-2025-40777), enabling cache poisoning and DoS attacks. Patch immediately!
A critical vulnerability was found in Cisco Identity Services Engine (ISE) and Cisco ISE-PIC. Tracked as CVE-2025-20337,...
Four critical flaws, including unauthenticated telnet access and RCE, discovered in Nexxt Solutions NCM-X1800 mesh routers allow full network compromise. Update or disable immediately.
Multiple critical vulnerabilities (CVSS up to 9.8) in Alcatel-Lucent OmniAccess Stellar WLAN APs enable unauthenticated remote code execution and full device takeover. Patch immediately!
NVIDIA patched critical vulnerabilities in its Container Toolkit and GPU Operator, allowing privilege escalation, data tampering, and DoS in containerized environments.