Do Son CERT@VDE warns of critical OS command injection flaws (CVE-2025-3626, CVE-2025-3705) in Frauscher railway systems, allowing remote admin compromise or physical attack via USB.
Vulnerability
JPCERT/CC warns of critical flaws in Nimesa Backup and Recovery (CVE-2025-48501, CVSS 9.8 RCE; CVE-2025-53473 SSRF). Unsupported versions pose severe risk to AWS data.
A critical flaw (CVE-2025-41672, CVSS 10.0) in WAGO Device Sphere allows unauthenticated attackers full admin control via shared default JWT certificates. Update to v1.0.1 immediately!
A flaw (CVE-2025-48367, CVSS 7.0) in Redis HyperLogLog allows authenticated RCE via out-of-bounds writes. PoC available. Update to 8.0.3, 7.4.5, 7.2.10, or 6.2.19!
Redis discloses CVE-2025-48367 (CVSSv4 7.0), a DoS flaw where authenticated clients can misuse multi-bulk commands. No direct code fix is planned; reinforce access controls.
Synacktiv unveils chained flaws in ScriptCase's prod console (CVE-2025-47227/47228) allowing pre-authenticated RCE via password reset & shell injection, risking web servers.
A critical Linux flaw (CVE-2025-6019) in udisksd/libblockdev allows local privilege escalation to root. PoC available. Update now to secure your system!
A flaw (CVE-2025-53367, CVSS 8.4) in DjVuLibre allows remote code execution on Linux via out-of-bounds write. PoC is available; patch to v3.5.29 immediately.
A critical flaw (CVE-2025-49826, CVSS 7.5) in Next.js causes cache poisoning, leading to DoS by serving cached HTTP 204 responses for static pages.
Microsoft Edge version 138.0.3351.65 fixes two RCE flaws: a V8 zero-day (CVE-2025-6554) actively exploited, and an Edge-specific type confusion (CVE-2025-49713).
PHP patches two flaws: CVE-2025-1735 allows SQL injection/crashes in pgsql, and CVE-2025-6491 enables DoS in SOAP via oversized XML. Update immediately!
Palo Alto Networks reveals thousands of exploit attempts targeting RCE flaws in Apache Tomcat (CVE-2025-24813) and Apache Camel (CVE-2025-27636, CVE-2025-29891).
A critical flaw (CVE-2025-34067, CVSS 10.0) in HIKVISION applyCT allows unauthenticated RCE via Fastjson deserialization, risking surveillance systems. Patch immediately!
Cymulate reveals two flaws (CVE-2025-53110, CVE-2025-53109) in Anthropic's Filesystem MCP Server, allowing path traversal, symlink attacks, and RCE, exposing AI developer machines.
A critical flaw (CVE-2025-34074, CVSS 9.4) in Lucee allows authenticated admins to achieve RCE by abusing scheduled tasks. A Metasploit module is out; urgent patching needed!
Dylan, 13, became Microsoft's youngest security researcher, uncovering a Teams flaw and prompting a Bug Bounty Program rule change. He has since submitted 20 reports.
Over 143,000 ICS devices in the power sector are publicly exposed to the internet, facing high/critical vulnerabilities. Urgent action is needed to secure global energy infrastructure.
A NFSundown flaw (CVE-2025-38089) in the Linux kernel allows remote attackers to crash NFS servers via a NULL pointer dereference. PoC exploit is public!
Actively Exploited Google Chrome Zero-Day (CVE-2025-6554) Added to CISA’s KEV Catalog, PoC Available
Actively Exploited Google Chrome Zero-Day (CVE-2025-6554) Added to CISA’s KEV Catalog, PoC Available
Google has urgently patched a high-severity zero-day (CVE-2025-6554) in Chrome's V8 JavaScript engine. This type confusion flaw is actively exploited in the wild, risking RCE.
Grafana warns of four critical RCE flaws in Image Renderer and Synthetic Monitoring Agent, stemming from Chromium V8 bugs. Update to patched versions immediately!
Cisco warns of two critical flaws (CVE-2025-20281, CVE-2025-20282, CVSS 10.0) in ISE and ISE-PIC allowing unauthenticated remote root code execution. Apply patches immediately.
A flaw (CVE-2025-6297, CVSS 8.2) in dpkg-deb allows DoS via disk quota exhaustion by leaving temporary files. Update immediately to prevent system instability.