Do Son A high-severity path traversal flaw (CVE-2025-23092) in Mitel OpenScape Accounting Management allows authenticated admins to upload malicious files for RCE. Update now!
Vulnerability
Ricoh warns of critical flaws in Streamline NX V3, including a CVSS 9.8 path traversal (CVE-2025-46783) allowing remote SYSTEM-level code execution.
A flaw (CVE-2025-5491) in Acer ControlCenter allows remote, unauthenticated attackers to escalate privileges to NT AUTHORITY\SYSTEM
Moxa warns of a high-severity DoS flaw (CVE-2024-9404) in PT-G7728/7828 industrial switches, allowing remote crashes. Update firmware or disable affected services.
CISA warns of active exploitation of a SimpleHelp RMM flaw (CVE-2024-57727) by ransomware actors, impacting utility billing software providers and their customers.
A new flaw (CVE-2025-6031) in the discontinued Amazon Cloud Cam allows attackers to intercept network traffic, highlighting risks of unsupported smart home devices.
Mitel warns of a critical path traversal flaw (CVSS 9.8) in MiCollab, allowing unauthenticated attackers to access provisioning data and perform admin actions.
Bosch warns of a critical RCE flaw (CVSS 10.0, CVE-2025-29902) in Telex RDC Server and RTS VLink, allowing unauthenticated remote code execution. Patch immediately!
A flaw (CVE-2025-49146) in PostgreSQL JDBC Driver allows MITM attacks even with channel binding enabled. Upgrade to v42.7.7 or use sslMode=verify-full.
A high-severity flaw (CVE-2025-4922) in HashiCorp Nomad allows privilege escalation via ACL policy lookup. Upgrade to Nomad 1.10.2 (or later) immediately.
Paragon's Graphite mercenary spyware exploited a zero-click iOS flaw (CVE-2025-43200) via iMessage, targeting journalists, confirmed by Citizen Lab
A medium-severity flaw (CVE-2025-41234) in Spring Framework allows Reflected File Download (RFD) attacks. Update to 6.2.8, 6.1.21, or 6.0.29 immediately
Mozilla has issued an urgent update for Firefox, patching two critical memory corruption flaws (CVSS 9.8) that could allow remote code execution. Update now!
Trend Micro Apex Central has two critical pre-authentication RCE flaws (CVSS 9.8, CVE-2025-49219, CVE-2025-49220). Patch immediately to prevent remote takeover.
A flaw (CVE-2025-4232) in GlobalProtect for macOS allows local users to escalate to root. Public PoC code exists. Update now!
GitLab issues urgent updates for high-severity flaws in CE/EE, including HTML injection (account takeover) and CI/CD code injection. Upgrade to 18.0.2, 17.11.4, or 17.10.8 immediately.
A critical flaw in OpenPGP.js (CVE-2025-47934) allows attackers to spoof valid signatures by appending malicious data to signed messages. PoC code available.
Three vulnerabilities (CVE-2025-41661, CVE-2025-41662, CVE-2025-41663) in Weidmueller IE-SR-2TX security routers allow unauthenticated remote root access. Update firmware immediately.
A IGEL OS 10 flaw (CVE-2025-47827) allows full Secure Boot bypass, enabling attackers to load untrusted kernels and rootkits. No patch is available.
Siemens Energy warns of a critical 9.9 CVSS flaw in its G5DFR component, allowing remote control via default credentials. Change passwords immediately!
A critical RCE flaw in QNX SDP's PCX image codec exposes systems to DoS or code execution. Patch immediately if using affected versions.
A TPM 2.0 flaw (CVE-2025-2884) allows local attackers to access sensitive memory or cause DoS. Update TPM firmware to protect trusted computing.