Do Son Two critical flaws (CVE-2025-46415, CVE-2025-46416) in guix-daemon allow local attackers to gain root access via socket exploitation and race conditions.
Vulnerability
CISA warns of critical flaws in MICROSENS NMP Web+ (v3.2.5 & earlier), including hardcoded JWTs, persistent sessions, and path traversal (CVSS 9.8 RCE). Update to 3.3.0 now!
Rapid7 warns of critical flaws (CVE-2024-51978, CVSS 9.8) in multi Brother printers, allowing auth bypass and RCE. Update firmware & change passwords immediately!
IBM warns of a high-severity flaw (CVE-2025-36004, CVSS 8.8) in IBM i Facsimile Support that allows local users to gain elevated privileges. Apply PTF SJ06024 immediately.
CISA warns of critical flaws in ControlID iDSecure On-premises, including SQL Injection, auth bypass, and SSRF, risking vehicle access control systems.
Quest KACE SMA faces critical flaws, including a CVSS 10.0 auth bypass (CVE-2025-32975) allowing full admin control. Update immediately to prevent RCE and compromise.
CISA warns of critical flaws in Kaleris Navis N4 terminal OS: unauthenticated RCE (CVSS 9.8) via Java deserialization and cleartext data transmission.
A critical flaw (CVE-2025-48703) in CentOS Web Panel allows unauthenticated RCE via authentication bypass and command injection, risking over 200,000 servers.
Elastic patches two Kibana flaws: CVE-2025-2135 (CVSS 9.9) allows heap corruption/RCE via Chromium, and CVE-2025-25012 (CVSS 4.3) is an open redirect/SSRF risk.
TeamViewer disclosed a high-severity flaw (CVE-2025-36537, CVSS 7.0) in its Remote Management for Windows, allowing local unprivileged users to delete files with SYSTEM privileges
NVIDIA warns of two high-severity flaws in its Megatron-LM LLM framework, allowing RCE and privilege escalation via malicious file input.
Hitachi Energy warns of 5 flaws in MicroSCADA X SYS600 (v10.0-10.6), including remote DoS, data leaks, and TLS MITM, risking power system control.
JPCERT/CC warns of critical flaws in ELECOM wireless LAN routers, including unauthenticated RCE (CVSS 9.8) via Telnet/SOAP. Many affected models are unsupported; replace them immediately.
Singapore's CSA warns of critical flaws in Advantech WISE-4010/50/60LAN industrial products, allowing unauthenticated firmware upload & Modbus manipulation.
Two severe Gogs flaws: CVE-2024-56731 (CVSS 10.0) allows RCE via symlink exploit, and CVE-2025-47943 (CVSS 6.3) is a stored XSS in PDF.js.
A critical flaw (CVE-2025-34037, CVSS 10.0) in Linksys E-Series routers allows unauthenticated remote command injection. TheMoon worm is actively exploiting it to infect devices.
A flaw (CVE-2025-6218, CVSS 7.8) in WinRAR allows remote code execution via directory traversal when opening crafted archives. Update to 7.12 Beta 1 immediately!
Two critical flaws (CVE-2025-6545, CVE-2025-6547, CVSS 9.1) in pbkdf2 npm package allow silent compromise of cryptographic keys. Update to 3.1.3+ immediately!
A critical flaw (CVE-2025-52562, CVSS 10.0) in Convoy KVM panel allows unauthenticated remote code execution via directory traversal.
A critical flaw (CVE-2025-4517, CVSS 9.4) in Python's tarfile module allows arbitrary file reads/writes outside the extraction directory. PoC is public; update immediately
A critical cryptographic flaw in Meshtastic (CVE-2025-52464) allows message decryption and node hijacking due to duplicated/low-entropy keys.
A critical path traversal flaw (CVE-2025-34022, CVSS 9.3) in Selea TARGA ANPR cameras allows unauthenticated remote access to sensitive files. PoC is public