Do Son A critical IBM Tivoli Monitoring flaw (CVSS 9.8) allows remote arbitrary code execution due to improper array validation. Update now.
Vulnerability
A ZITADEL vulnerability allows host header injection to hijack user accounts via password reset links. Update to 3.2.2+ or configure proxy.
A critical Icinga 2 vulnerability (CVSS 9.3) allows malicious certificate impersonation, affecting builds with older OpenSSL. Update now!
ISC uncovers security flaws in its Kea DHCP server, including privilege escalation and data leakage. Update to Kea 2.4.2, 2.6.3, or 2.7.9 immediately.
A critical Mitsubishi MELSEC iQ-F Series CPU module flaw allows remote DoS and info leak. No software patch available.
A critical Tenda W18Ev2 router flaw allows unauthenticated RCE via admin password change. PoC available, no patch yet.
A critical XSS vulnerability (CVSS 9.1) in Argo CD allows attackers to hijack user sessions and control Kubernetes resources. Update to fix
Redis versions 7.0+ are vulnerable to RCE via a stack buffer overflow in redis-check-aof. Update to 8.0.2, 7.4.4, or 7.2.9.
Java applications face a critical risk! A flaw in Apache Commons BeanUtils (CVSS 8.8) can lead to arbitrary code execution. Update immediately.
CHOICEJACKING, a new USB attack, bypasses existing JuiceJacking mitigations on Android and iOS by simulating user input via malicious chargers.
Citrix has patched high-severity flaws in XenServer VM Tools for Windows that could allow attackers to compromise guest VMs. Update to version 9.4.1.
A critical Cyrus IMAP vulnerability (CVSS 9.8) on openSUSE allows unprivileged users to gain root access, risking full system compromise.
Amazon Redshift Python Connector has a high severity vulnerability allowing OAuth2 token interception due to missing SSL validation.
A critical Firefox vulnerability in libvpx allows remote code execution without user interaction beyond normal Browse. Update immediately!
Google Chrome 137 is out, patching 11 vulnerabilities including high-severity use-after-free (CVE-2025-5063) and V8 flaws. Update now!
Critical flaws (CVSS 9.8) in Weidmueller industrial switches allow unauthenticated remote attackers full system compromise. Update firmware.
Mimo (Hezb) is exploiting an unauthenticated RCE (CVE-2025-32432) in Craft CMS to deploy webshells, cryptominers, and proxyware. Patch now!
A critical GitHub MCP server vulnerability allows AI agent hijacking via prompt injection, leading to data exfiltration from private repositories.
Lenze VPN Client for x500 IoT gateways has critical flaws allowing arbitrary code execution via local privilege escalation.
Critical (CVSS 10) unpatched flaw in TI WooCommerce Wishlist allows unauthenticated RCE via file upload. Affects 100K+ sites.
New research reveals a high-severity mesh Wi-Fi vulnerability (CVSS 9.1) enabling frame injection even without credentials. PoC available.
GIMP versions before 2.99.16 & 3.0.0 are vulnerable to RCE from crafted image files. Patch now to protect your system.