Do Son Veeam released a critical update for Backup & Replication, patching three flaws, including a CVSS 9.9 RCE (CVE-2025-23121) allowing authenticated users to execute code.
Vulnerability
Google Chrome 137.0.7151.119/.120 is rolling out with crucial security fixes, addressing two high-severity flaws: an integer overflow in V8 and a use-after-free in Profiler.
Microsoft disabled Windows Hello facial recognition in dark environments on Windows 10/11 due to a security flaw that could allow local spoofing attacks.
ASUS warns of a high-severity flaw in Armoury Crate that allows authentication bypass and privilege escalation. Update immediately!
Teleport disclosed a critical remote authentication bypass flaw (CVE-2025-49825) affecting self-hosted instances. Upgrade Proxies and agents immediately!
A critical flaw (CVE-2025-49596, CVSS 9.4) in MCP Inspector allows unauthenticated remote code execution, threatening AI application development environments.
SUSE disclosed flaws in sslh (CVE-2025-46807, CVE-2025-46806) allowing remote DoS attacks via file descriptor exhaustion and unsafe memory access.
BeyondTrust warns of a high-severity unauthenticated RCE flaw in Remote Support and PRA, exploitable via the built-in chat feature. Patch immediately
Apache Tomcat patched four vulnerabilities affecting versions 9.0, 10.1, and 11.0, ranging from DoS to privilege bypass. Update immediately
CISA adds two actively exploited zero-days to KEV: an iOS zero-click flaw used by spyware (CVE-2025-43200) and a command injection in TP-Link routers
A critical flaw in OneLogin's AD Connector exposed API keys, allowing attackers to impersonate users across organizations via unclaimed S3 buckets and forged JWT tokens.
PoCGen is a new AI tool using LLMs, static, and dynamic analysis to automate PoC exploit generation for npm vulnerabilities, achieving high success rates at low cost.
Zyxel firewalls are under a coordinated attack exploiting critical RCE flaw CVE-2023-28771 (CVSS 9.8) via UDP port 500, likely by Mirai botnets. Patch immediately
A critical RCE flaw (CVE-2025-3248) in Langflow is being actively exploited to deploy the stealthy Flodrix botnet for reconnaissance and diverse DDoS attacks on AI app servers.
Unauthenticated RCE flaw in Mitel SIP phones (CVSS 9.8) lets attackers gain root via ringtone upload. Exploit PoC shows full system compromise.
Five critical flaws (CVSS 9.8) in Blink routers allow unauthenticated remote root code execution via command injection in web server components.
Critical flaws (CVE-2025-6029, CVE-2025-6030) in KIA Ecuador key fobs allow remote vehicle unlocking and control via insecure learning code technology.
A high-severity flaw (CVE-2025-33108) in IBM BRMS for i allows users with specific capabilities to gain elevated privileges. Update to PTF SJ05907 (7.5) or SJ05906 (7.4).
Four flaws in libxml2 (CVE-2025-6021, CVE-2025-49794, CVE-2025-49795, CVE-2025-49796) expose systems to memory corruption, RCE, and DoS attacks.
A spoofing flaw (CVE-2025-26685) in Microsoft Defender for Identity, combined with other vulnerabilities, enables unauthenticated privilege escalation to Active Directory.
A critical Windows SMB client flaw (CVE-2025-33073, CVSS 8.8) allows remote SYSTEM privilege escalation via Kerberos authentication. PoC available.
A medium-severity flaw (CVE-2025-3415) in Grafana Alerting exposes sensitive DingDing contact point URLs to viewers. Update to patch or disable the integration