Do Son A high-severity flaw (CVE-2025-37100) in HPE Aruba Private 5G Core allows unauthorized access to sensitive system files. Update to 1.25.1.1 immediately!
Vulnerability
Apache CloudStack LTS updates patch five security flaws, including two critical vulnerabilities in Kubernetes and admin access, risking full system compromise.
A critical Konsole vulnerability allows arbitrary code execution via a telnet:// URL scheme. Linux users must update to 25.04.2 immediately.
A high-severity flaw (CVE-2024-43706) in Kibana's Synthetic Monitoring allows unauthorized access. Upgrade to 8.12.1 or apply mitigations immediately.
Ivanti patches three Workspace Control flaws exposing sensitive credentials due to hardcoded keys. Update immediately to secure your enterprise.
A Insyde H2O UEFI flaw (CVE-2025-4275) allows Secure Boot bypass via NVRAM, enabling attackers to inject undetectable malware and rootkits. Update firmware now!
Google Chrome 137.0.7151.103/.104 fixes two high-severity flaws in media and V8. Update now to protect your system from potential compromise.
A critical CVSS 9.8 flaw (CVE-2025-49653) in Backend.AI allows account takeover via PoC, impacting all versions. Vendor has not issued a patch.
A DoS flaw in CoreDNS (CVE-2025-47950) allows unauthenticated attackers to crash servers using DNS-over-QUIC. Update to 1.12.2 immediately or disable QUIC.
A UEFI Secure Boot flaw (CVE-2025-3052) allows attackers to bypass security and execute untrusted code on millions of devices. Patch now!
Microsoft's June 2025 Patch Tuesday fixes 69 vulnerabilities, including two exploited zero-days in WebDAV and Windows SMB Client. Patch immediately!
A critical XXE vulnerability (CVSS 9.9) in GeoTools llows data disclosure and RCE. Update immediately to patched versions!
A critical privilege escalation flaw (CVE-2025-4601) in RealHomes WordPress theme allows low-privilege users to become admins. Update now!
CISA adds two critical vulnerabilities to KEV: Erlang/OTP (RCE) and Roundcube (XSS). Actively exploited, these flaws pose severe risks to systems and email accounts.
A critical RLS vulnerability (CVSS 9.3) in the Lovable low-code platform exposes sensitive user data and allows unauthorized modification.
A critical authentication bypass (CVE-2025-41646) affects KUNBUS RevPi Webstatus. Exploiting implicit type conversion allows attackers full access.
Akamai reports active exploitation of critical Wazuh RCE (CVE-2025-24016) by multiple Mirai botnets, targeting IoT devices since March 2025.
A critical RCE flaw (CVE-2025-3835) in ManageEngine Exchange Reporter Plus allows unauthenticated attackers to execute arbitrary commands. Update now!
A critical 9.8 CVSS vulnerability in PayU CommercePro for WordPress allows unauthenticated admin account takeover. No patch available, immediate removal advised.
Critical flaws in Microsoft's Brokering File System (BFS), including race conditions and UAF bugs, expose Windows to privilege escalation. PoC code available. Patch now!
QNAP releases urgent patches for high-severity flaws in Qsync Central and File Station 5, enabling RCE and data compromise. Update immediately!
Explore a critical vBulletin RCE vulnerability stemming from a flawed patch. This article details the PHP Object Injection leading to RCE, complete with a PoC