Do Son A critical flaw (CVE-2025-4981, CVSS 9.9) in Mattermost allows authenticated users to achieve RCE via path traversal during archive uploads. Update immediately!
Vulnerability
IBM warns of three critical QRadar SIEM flaws (CVSS 9.1 RCE, XXE, info disclosure). Update to 7.5.0 UP12 IF02 immediately to protect your SIEM.
A critical RCE flaw (CVE-2025-49132, CVSS 10.0) in Pterodactyl game server panel allows unauthenticated arbitrary code execution. Malicious actors are already exploiting it.
A flaw in the OpenVPN Windows kernel driver allows unprivileged local users to crash systems (BSOD) via oversized control packets. Update to 2.6.14-I002.
A critical flaw (CVE-2025-4322) in the WordPress Motors theme allows unauthenticated attackers to reset passwords for full site takeover.
A critical flaw (CVE-2024-45208, CVSS 9.8) in Versa Director allows unauthenticated RCE via exposed HA ports. PoC code is public, demanding immediate hardening.
A critical flaw (CVE-2025-4404, CVSS 9.1) in FreeIPA allows authenticated users to escalate privileges to domain admin via Kerberos impersonation.
CISA warns fuel infrastructure operators of a critical flaw (CVE-2025-5310) in Dover Fueling Solutions ProGauge MagLink devices, risking control
Two flaws in Versa Director SD-WAN allow authenticated RCE via insecure file uploads and privilege escalation via webhook abuse. PoC code is public.
A critical flaw (CVE-2025-24288, CVSS 9.8) in Versa Director exposes hardcoded default credentials for high-privilege accounts with sudo access. PoC released. Update now
Cisco ClamAV versions 1.4.3 and 1.0.9 fix critical flaws: CVE-2025-20260 (CVSS 9.8) in PDF scanning could allow RCE, and CVE-2025-20234 (UDF) leads to DoS.
A critical flaw (CVE-2025-5071) in WordPress's AI Engine plugin allows subscribers to escalate privileges and take over websites with Dev Tools/MCP enabled.
Cisco warns of a critical flaw (CVE-2025-20271, CVSS 8.6) in Meraki MX/Z Series devices, allowing unauthenticated remote DoS on AnyConnect VPN. Update firmware now!
Two critical flaws in Apache Traffic Server (CVE-2025-31698, CVE-2025-49763) allow IP-based ACL bypass and remote DoS via ESI plugin.
A high-severity flaw (CVE-2025-6020) in Linux PAM's pam_namespace allows unprivileged users to gain root via symlink attacks and race conditions.
A critical SSRF flaw (CVE-2025-6087) in @opennextjs/cloudflare allows unauthenticated users to proxy arbitrary remote content via /_next/image endpoint.
A critical flaw (CVE-2025-51381) in KAON KCM3100 Wi-Fi gateways allows local attackers to bypass authentication. Update firmware to version 1.4.8 immediately.
A high-severity flaw (CVE-2025-4565) in Google's pure-Python Protobuf backend allows unauthenticated attackers to crash applications via crafted nested messages.
Two critical buffer overflow flaws in D-Link router allow remote code execution. PoC available, no patch will be issued.
Two high-severity Ubiquiti flaws allow privilege escalation via XSS in UCRM and authenticated SQL injection in UISP. Update immediately!
Qualys uncovered two critical Linux flaws (CVE-2025-6018, CVE-2025-6019) allowing local root privilege escalation via PAM and UDisks. Patching is urgent for major distros.
Cloud Software Group issues urgent patches for two critical NetScaler flaws allowing access bypass and memory overread. Update immediately.